Device-scoped vault sync: limit which folders/collections/items sync to specific devices (e.g. mobile “travel” vault)

Summary I'd like a way to restrict which vault items sync to (or are decryptable on) specific devices. Example: my phone should only get low-risk day-to-day secrets (office Wi‑Fi, door PIN), while high-value items (SSH keys, banking, recovery codes) stay available on trusted devices (desktop / laptop) and never sync to mobile. Motivation Phones are higher risk (loss, theft, border/device search, biometric unlock). Syncing the full vault to every logged-in client means a compromised phone exposes everything, including secrets that are never needed on that device. Proposed behavior Prefer server-enforced sync scopes over client-only hiding (so excluded items never reach the device local vault). Possible approaches (any of these would help): 1. Per-device allowlist / denylist of folders and/or organization collections 2. Item/folder "device policy" (e.g. allowed device types: desktop, browser / deny: mobile) 3. Named sync profiles ("Full", &qu…