BF: allow _dec without _enc in codec registry

- permit deprecated _decrypt but not encrypt
  so that you can rotate out of a deprecated codec
- add a test for this
- minor code and docstring cleanup