

add keepassxc to the list. I’ve avoided it for the longest times because I remember the horror that was the OG keepass. this is modern software, minimal footprint (miniscule compared to bitwarden’s electron crap), easy to use, the db is one file that’s easily syncthing-ed around, browser extensions, etc.
you already stated both options, there is no option #3. snapdragon support isn’t there yet, you’ll have to make do with Intel and AMD options; for the stated use cases, even 5-year old models will serve you plenty. ideapads, thinkbooks, whatevers are consumer-class models and shouldn’t be gotten used (not even new, in my opinion) as they have nothing in common with T-series thinkpads.
if you’d like to hang on to your hardware for longer, go with the T14 (no S-suffix) as those things are easily expandable, serviceable and cross-generation compatible (same docks etc.).