fix(sync): add defensive undefined guard and clarify revert comment

- Add undefined guard for newClock[clientId] in SyncHydrationService
  clock reset, matching the pattern in OperationLogStoreService
- Clarify enableEncryption revert comment explaining why explicit
  overrides exist despite existingCfg already having correct values

src/app/imex/sync/supersync-encryption-toggle.service.ts

@@ -59,7 +59,10 @@ export class SuperSyncEncryptionToggleService {
       // Revert config on failure (server data is already deleted at this point)
       SyncLog.err(`${LOG_PREFIX}: Failed after deleting server data!`, error);
 
-      // Best-effort revert: restore original config (preserves auth credentials and original encryption state)
+      // Best-effort revert: restore pre-enable config.
+      // existingCfg was captured before enabling, so it already has isEncryptionEnabled: false
+      // and no encryptKey. The explicit overrides ensure correctness even if the guard above
+      // was bypassed (e.g., existingCfg was partially set).
       await this._providerManager.setProviderConfig(SyncProviderId.SuperSync, {
         ...existingCfg,
         encryptKey: undefined,

src/app/op-log/persistence/sync-hydration.service.ts

@@ -252,7 +252,10 @@ export class SyncHydrationService {
       let clockForStorage: Record<string, number>;
       if (createSyncImportOp) {
         clockForStorage = {};
-        clockForStorage[clientId] = newClock[clientId];
+        // Guard against undefined — consistent with mergeRemoteOpClocks() in OperationLogStoreService
+        if (newClock[clientId] !== undefined) {
+          clockForStorage[clientId] = newClock[clientId];
+        }
         OpLog.normal('SyncHydrationService: Reset working clock to minimal after sync', {
           fullClockSize: Object.keys(newClock).length,
           minimalClockSize: Object.keys(clockForStorage).length,