Spec wise, I'm thinking either NIP4 for each password, or maybe a NIP51 encrypted list of all passwords.

It would be best for the client to be cross platform, desktop, android, ios. No need for app stores, sideloading is good enough (at least for Android, dunno / don't care about ios myself)

Maybe the NIP4 encryption should be ontop of a password encryption, kinda like a 2fa, the client remembers the private key, but always requires the password to fully decrypt. But maybe a 13th word passphrase works better.