More API Control - especially passwords & OTP Secrets

Right now, the asset_passwords endpoint returns OTP secrets bundled together with password data. Any integration that needs password data — like a password rotation/PAM platform (e.g., CyberQP) — ends up pulling OTP secrets too, even though it has no legitimate use for them.

Ask: Remove OTP secrets from the standard asset_passwords response, and expose them only through a separate field or endpoint that requires its own distinct API permission/scope.

Why this matters: This lets us scope third-party integrations to exactly the data they need. A password rotation platform needs passwords, not OTP secrets — bundling the two together means every integration we authorize inherits access to OTP data by default, regardless of whether it needs it. Separating them follows basic least-privilege/need-to-know practice and shrinks the blast radius if any single integration is ever compromised.

Bonus: Be able to scope a key to only allow specific clients. Right now, you can do that, but that "client" field is limited to only a specific client.