You could also route any calls to /api through authentication. However I am not sure if that can cause any problems. Is there a list of endpoints that need to be reachable for federation to work?

Never noticed anything in the last couple of weeks. I had one podcast missing new episodes because the schedule was turned off. But I might not have had it turned on in the first place.

ntfy and FreshRSS for me. Audiobookshelf recently joined and I am using it daily. (Inofficial probably the Arr stack though 😅)