pub fn maybe_decrypt_text(stored: &str) -> String
Decrypt a text field. A value that doesn’t look encrypted (or can’t be decrypted) is returned as-is — pre-migration rows and encryption-off rows.