How to map encrypted URL parameter (pid) to AJO form hidden field for profile identity stitching?

Hi Adobe Community,

We're currently implementing a preference center/unsubscribe landing page 
using AJO campaigns with URL parameter encryption enabled via the 
Key Registry.

**Current Setup:**
- AJO email campaign uses the encrypt() helper in personalization editor
- Email links include encrypted parameters: ?pid=v1.towEToq9cGLgo9x4...
- Landing page is built using AJO Forms (not custom HTML)
- Form is tied to an AEP profile-enabled dataset for capturing preferences

**What We're Trying to Achieve:**
When a user clicks the email link and lands on the form page:
1. The encrypted pid (profile/identity) should be captured from the URL
2. Assigned to a form hidden field automatically
3. When the form is submitted, the pid should be mapped to a profile 
   identity namespace (Email or CRM ID)
4. Form submission data should stitch to the existing profile in AEP 
   for preference updates

**Our Questions:**

1. **In AJO Forms Designer** - Can we configure a hidden field to 
   automatically capture and map URL parameters to identity namespaces? 
   Or do hidden fields only support static default values?

2. **Encryption Handling** - Does AJO Forms handle decryption of encrypted 
   URL parameters automatically, or do we need to:
   - Decrypt the pid on a backend API first?
   - Decrypt on the landing page frontend (JavaScript)?

3. **Identity Stitching** - If we map the pid to a hidden field, will AEP 
   automatically stitch the form submission to the correct profile using 
   the identity in the dataset's identityMap?

4. **Best Practice** - What's the recommended approach for AJO Forms 
   + encrypted URL parameters + profile stitching workflow?

Any guidance or examples would be appreciated!