1)The rabbit hole goes deep, but other than replacing your router with a secure beast which runs behind your VPN, as long as you connect through tor you're good. 

2) Personally I'd avoid the media aspect. 

3&4) Power down and clone the drive once setup completes. Use Balena etcher or similar. You can also clone an existing drive to a larger one. The backup would need to catch up on the latest blocks if/when used.