decryptUnenveloped
suspend fun decryptUnenveloped(cipher: Cipher, ciphertext: ByteArray, associatedData: ByteArray? = null): ByteArray
Decrypts a raw Tink AEAD (or Cipher-compatible) blob that has no ENCRYPTED_BLOB_MAGIC envelope — e.g. older AeadSerializer-shaped payloads.
After decrypt, re-write via EncryptedProtoSerializer / EncryptedPreferencesSerializer so subsequent reads use envelope v1.