Any insight on why you prefer the nginx ingress vs the ALB ingress controller on AWS? you can group/combine ingresses as well and it will automatically load the correct certificate from ACM if it exists. Which means you won't have to mess around with certbot. Your TLS ends in the loadbalancer in that case though.
EKS managed addons now support custom configuration( might not have when you started out ) though maybe not all the custom features you're looking for are there. It's not as flexible as the helm chart obviously, but usually supports the most basic things you'd want to use.
Interesting read otherwise!
Personally I've had issues selling people on gitops/kustomize as they all find helm charts a lot easier.
I think bitwarden checks all the boxes. It's 3.33$ per month for a family plan ( 6 users). I've used it for a long time and I'm happy with it.
If you want more privacy you can always self host vault warden and use that. In which case you have full access to the premium features and you just pay the hosting costs.
Bitwarden can be set as the default password manager in browsers. Stores TOTP codes, has a browser plugin, has android app and iOS app.
Works flawlessly in my experience ( Linux/macbook/android).
No experience with iphones, but I assume it is fully supported.