Function decrypt_provider_token_bound 

pub fn decrypt_provider_token_bound(
    key: &TokenEncryptionKey,
    stored: &str,
    aad: &[u8],
) -> Result<String, AuthError>

Decrypt a stored provider refresh token, verifying aad for the current "enc2:" format.

Legacy "enc:" values carry no binding and decrypt regardless of aad (back-compat with rows written before AAD binding existed). If the stored value has neither prefix it is returned as-is — this handles legacy plaintext rows and the case where no encryption key is configured.