Modem-ethernet to main deco-ethernet to slave deco in basement-ethernet to PC
Yes this would work just fine as you are hoping, also if you only need/want two units the Deco XE75 is a $100 off right now making it 200 usd, but the m4 would be a great choice too, you just get Wifi 6E with the 75s.
No. Just VPN in and SSH in.
https://docs.linuxserver.io/images/docker-swag/
I would tell you to entertain swag, has a lot of pre-built configs and has some integration with crowdsec and docker mods.
Clients just work, no matter what I have tried with the jellyfin client on android tv it always fails on first or second load up, also subtitles never quite work as smoothly as they could.
You can download movies or tv shows from your library so you could watch them while without internet, nice for road trips or flights.
Also I use https://trash-guides.info/ for all my setup for subtitles and no matter what I tweak they just are always a little off with jellyfin, no so with plex.
I just switched with this latest sale to plex from jellyfin and here is so far as to why.
To add about my server, it is a xeon 1231 v3, 32gb ram, 20tb raidz1 and a nvidia p2000 on a 200/200 fiber connection (using pfsense).
If all you want to do is forward to google and redirect internally just use unbound or knot.
I self host vaultwarden but I also pay teh $10/year to support the project, I self host for Collections and I use the paid bitwarden at work since they do not allow ddns addresses in our network.
As long as passwords are strong it's usually fine, I use ldap through jellyfin on authentik and everyone gets a passphrase.
Between them Immich is a lot easier to use, the app is much nicer I have found.
Also if you are not using nextcloud for other features, installing just for photos is a huge drag on resources.
Also immich just added gpu support.
They install just like any other container.
I just use hotio suite which has been great, I run bazarr, prowlarr, qbitmanage, qbittorrent, radarr, sonarr, sabnzbd, and unpackerr on an old asustor nas.
This was your solution, if that is not an option than there is no solution.