Function encrypt_provider_token 

pub fn encrypt_provider_token(
    key: &TokenEncryptionKey,
    plaintext: &str,
) -> Result<String, AuthError>

Encrypt a provider refresh token in the legacy unbound format.

Returns "enc:<base64url(nonce||ciphertext)>". New write paths should use encrypt_provider_token_bound so the ciphertext is tied to its row identity; this function remains for compatibility and tests.