WRT #4, instead of a "push" from the camera to the web server/cloud, you might consider a "pull"- ffmpeg is your Swiss Army knife here.
It sounds like you are well aware of security issues ... so yea, make sure you have 'em locked down well.
BTW, I have a some IPC-T54IR-ZE-S3's running version...