decrypt() can legitimately return null (a previously-encrypted null
value), which violated the non-nullable string return type and
crashed callers with "Return value must be of type string, null
returned". Treat that the same as the existing invalid-payload case:
the password isn't usably encrypted, so fall back to the raw stored
value. Loosen the return type to ?string to match.