pub fn decrypt( ciphertext_b64: &str, nonce_b64: &str, key: &[u8; 32], ) -> Result<String>
Decrypt ciphertext using AES-256-GCM