Function maybe_decrypt_bound 

pub fn maybe_decrypt_bound(
    key: Option<&TokenEncryptionKey>,
    stored: &str,
    aad: &[u8],
) -> Result<String, AuthError>

Attempt to decrypt stored if it carries the "enc2:" or "enc:" prefix, verifying aad for the bound format. If no key is provided but the value is encrypted, return an error — the caller should not silently return ciphertext as the token value.