[FEATURE] Profiles within one account (separate history, memory, config) with profile-only sign-in for client machines

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

I am one person on one Max subscription. I work on my own machine and on a client's machine, on the client's repository. Today both machines sign in to the same account, so the client's PC shows my personal chats, my other clients' chats, and their memory — and vice versa. The only ways to separate contexts are a second paid account per client, or signing out and back in every time, which loses the desktop session and Claude Code config. Neither is proportionate for a single user who simply works in several places.

Proposed Solution

Allow one account to hold several profiles (e.g. "Personal", "Client A", "Client B"). Each profile has its own chat history, Projects, memory, preferences, connectors and Claude Code configuration (~/.claude follows the profile). Nothing in one profile is visible from another.

Two ways to sign in:

1. Full account sign-in — sees all profiles and can switch between them (my own machine).
2. Profile sign-in — a credential that opens exactly one profile, with no switcher and no access to the others (a client's machine). A machine signed in this way can never show or reach my other profiles, even if left unlocked or later compromised.

Applies to claude.ai, the Desktop app and Claude Code.

Alternative Solutions

• Separate accounts per client: works, but each needs its own subscription and the usage limits do not pool; overkill for one person.
• Sign out / sign in: loses the Desktop session and Claude Code state each time; error-prone on a client machine.
• Projects: separate memory, but every chat is still listed in the sidebar, so visibility is not separated.
• CLAUDE_CONFIG_DIR per account for the CLI: only covers the terminal, not chat history or the Desktop app.
• Third-party profile launchers (separate Electron data dirs): run multiple accounts, not one account with isolated profiles; no security boundary.

Priority

High - Significant impact on productivity

Feature Category

Configuration and settings

Use Case Example

1. On my own PC I sign in with the full account and switch between "Personal" and "Client A" as needed.
2. On Client A's PC I sign in with the "Client A" profile credential only. That machine shows only Client A's chats, memory and Claude Code config.
3. Someone else uses that PC later, or it is imaged by their IT — nothing of mine outside "Client A" was ever on it.
4. When the engagement ends I revoke the "Client A" profile credential; my account and other profiles are untouched.

Additional Context

Related but different: #18435, #89785, #89993 ask for switching between separate accounts. This asks for isolated profiles under ONE account and ONE subscription, plus a profile-scoped credential that cannot reach the other profiles. The model is browser profiles, with the added security property of a profile-only login for machines the user does not own. Also submitted via claude.ai support and Claude Code /feedback.