Use and host Vaultwarden (Bitwarden-compatible) password vaults. Use a vault: read credentials with the pinned bw 2025.4.0 CLI and vault-fetch.sh, with a local `.credentials` fallback. Host a vault for people: run the official Vaultwarden server for the owner, as a shared-tent CLAW service (digest-verified install without Docker, a socket bridge within the service limits) or on their dedicated VM behind Caddy.