Bug (Monkey Power): reset() deletes timeout id before clearTimeout — pending shake reset always fires; randomColor() can emit invalid hex

Did you clear cache before opening an issue?

• I have cleared my cache

Is there an existing issue for this?

• I have searched the existing open and closed issues

Does the issue happen when logged in?

N/A

Does the issue happen when logged out?

Yes (source-code bug, independent of account state)

Does the issue happen in incognito mode when logged in?

N/A

Does the issue happen in incognito mode when logged out?

N/A

Issue details

Current Behavior

Two bugs in frontend/src/ts/elements/monkey-power.ts (Monkey Power screen-shake/spark effect):

1. reset() clears an already-deleted timeout id (monkey-power.ts:171-175):

export function reset(immediate = false): void {
  if (!isSafeNumber(ctx.resetTimeOut)) return;
  delete ctx.resetTimeOut;      // id removed first...
  clearTimeout(ctx.resetTimeOut); // ...so this clears `undefined` — always a no-op

The property is deleted before clearTimeout reads it, so the pending 2000ms shake-reset timeout scheduled in addPower() (monkey-power.ts:222-223) is never actually cancelled and always fires later, re-running reset() even after it was already invoked early (e.g. from test-ui.ts:1854). This can cause a delayed/duplicate body-transform reset.

2. randomColor() produces invalid hex colors (monkey-power.ts:198-203):

const r = Math.floor(Math.random() * 256).toString(16); // can be 1 char, e.g. "a"
return `#${r}${g}${b}`; // e.g. "#fa2" — invalid CSS color

Channel values below 16 produce single-digit hex strings without zero-padding, generating malformed 3–5 character colors like #fa2c or #a12. Sparks randomly lose their intended color.

Expected Behavior

clearTimeout(ctx.resetTimeOut);
delete ctx.resetTimeOut;

and

const toHex = (n: number) => n.toString(16).padStart(2, "0");

Steps To Reproduce

1. Enable Monkey Power level 3+ in settings.
2. Type quickly to trigger powers repeatedly and reset mid-shake.
3. Observe the delayed shake reset firing ~2s after reset() was already called; sparks intermittently render with broken/no color.

Environment

• OS: Any
• Browser: Any
• Found via source review of master @ 91bd24bb8