Simplify secret backend fallback

AUDIT.md

@@ -33,6 +33,7 @@ after each item.
 - [x] `ai/openai_compatible_runtime.ex`
 - [x] `ai/one_shot.ex`
 - [x] `ai/secret_key.ex`
+- [x] `ai/secret_backend.ex`
 
 ---
 

lib/bds/ai/secret_backend.ex

@@ -41,10 +41,7 @@ defmodule BDS.AI.SecretBackend do
   @spec decrypt(String.t()) :: {:ok, String.t()} | {:error, term()}
   def decrypt(encoded) when is_binary(encoded) do
     with {:ok, key} <- secret_key() do
-      case decrypt_with(encoded, key) do
+      decrypt_with_fallback(encoded, key)
-        {:ok, plaintext} -> {:ok, plaintext}
-        {:error, :invalid_ciphertext} -> decrypt_legacy(encoded)
-      end
     end
   end
 
@@ -79,6 +76,13 @@ defmodule BDS.AI.SecretBackend do
     ]
   end
 
+  defp decrypt_with_fallback(encoded, key) do
+    case decrypt_with(encoded, key) do
+      {:ok, _plaintext} = ok -> ok
+      {:error, :invalid_ciphertext} -> decrypt_legacy(encoded)
+    end
+  end
+
   defp decrypt_with(encoded, key) do
     with {:ok, binary} <- Base.decode64(encoded),
          <<iv::binary-size(12), tag::binary-size(16), ciphertext::binary>> <- binary,