feat(hint): persist the vs_ai idle-hint wait (wall-clock + read sanitiser)

Per the owner's call, the idle-hint gate now PERSISTS across leaving and reopening the
app, instead of the session-scoped monotonic clock: the unlock is a wall-clock instant
(hintUnlockAtMs) stamped from the robot's reply, stored on the local record, carried on
the game view + the opponent_moved move delta, and read through a sanitiser that caps it
at now + the window. So:
- the wait survives a relaunch (a stuck turn is not forgotten);
- a device clock set BACK cannot freeze the gate (the cap bounds the remaining to the
  window and self-heals on the next read);
- a clock set FORWARD just opens the hint early -- accepted as harmless for a solo game.

- lib/hints.ts hintGateRemainingMs now takes the unlock instant + clamps to the window.
- localgame: re-add hintUnlockAtMs to the record/meta; stamp it off the robot's reply;
  sanitise on read (a shared hintUnlock helper feeds stateView + the opponent_moved event).
- gamedelta + PushEvent: the move delta carries hintUnlockAtMs so the view stays fresh.
- Game.svelte: hintUnlockAt derives from the view; the tick + lock + toast unchanged.
- offline.spec.ts: also assert the lock survives a reload (the wait persisted).
- Docs FUNCTIONAL(+_ru)/ARCHITECTURE updated (persist + sanitiser, not monotonic-resets).

ui/src/lib/hints.ts

@@ -30,19 +30,23 @@ export const HINT_GATE_MS = 30 * 60 * 1000;
 
 /**
  * hintGateRemainingMs returns how long (in milliseconds) until a vs_ai game's idle hint unlocks — 0
- * once it is available. It is measured from a MONOTONIC clock (performance.now()), never a wall-clock
- * timestamp, so a device clock change — by the user or an auto-sync — can neither open nor freeze the
- * gate. gateStartMono is the performance.now() captured when the current turn's wait began; null
- * means the gate is open (the human's first move, or not a gated game). The vs_ai hint is unlimited
- * and wallet-free; this idle gate is an anti-frustration aid that unlocks only after a stuck turn.
+ * once it is available. hintUnlockAtMs is the wall-clock instant the hint opens (the robot's last
+ * move plus the idle window), persisted so the wait survives leaving and reopening the app; 0 or
+ * undefined means the gate is open (the human's first move, or a non-gated game).
+ *
+ * The result is CLAMPED to the window. A wall-clock timestamp is the only way to carry idle time
+ * across an app relaunch, but a device clock the player changes (or an auto-sync) could push the
+ * unlock far into the future and freeze the gate; capping the remaining at the window means the wait
+ * is never longer than intended and self-heals (the caller re-reads a sanitised value on load). A
+ * clock moved forward simply opens the hint early — harmless for this solo anti-frustration aid.
  */
 export function hintGateRemainingMs(
-  gateStartMono: number | null,
-  monoNow: number,
+  hintUnlockAtMs: number | undefined,
+  nowMs: number,
   gateMs: number = HINT_GATE_MS,
 ): number {
-  if (gateStartMono === null) return 0;
-  return Math.max(0, gateMs - (monoNow - gateStartMono));
+  if (!hintUnlockAtMs) return 0;
+  return Math.min(gateMs, Math.max(0, hintUnlockAtMs - nowMs));
 }
 
 /** hintLockMinutes rounds a remaining-milliseconds gap up to whole minutes for the "available in N