Let an entry restrict which credentials appear in the credential prompt

Current behavior
When an entry (or a Host template) uses Linked (vault) credentials pointed at a Password List or a folder, the prompt at launch shows every row/entry in that list. There is no way to narrow it per entry.

Problem
As an MSP I keep one Password List per client with every user's login. When I open a workstation I only ever want two options: that machine's end user and the shared admin account. Instead I get the full list of 20+ rows and have to scroll or type into the search box on every launch. The current workarounds (a sub-list or subfolder per machine, or a separate RDP entry per credential) multiply entries and defeat the point of centralizing the list.

Request
On any entry whose Credentials are Linked (vault) to a Password List or folder, add an optional "Allowed credentials" selector: a multi-select of the rows/entries in that list. At launch, the prompt shows only the selected rows. If exactly one is selected, connect without prompting.

Nice-to-haves
- Same selector on Host entries, so host-launched templates with Inherited credentials receive the filtered set.
- Allow a shared entry (e.g. the admin account) to be pinned so it always appears first.

Benefit
One credential list per client, one entry per machine, two clicks to connect as either the user or the admin. No duplicated credentials, no per-machine folders.