Haven't had a samsung phone since the note 3, but I remember having issues with unlocking the bootloader, I think you had to use some 3rd party tool because samsung provided no guide in their manual. With nexus and pixel phones it's really easy so them I can definately recommend.

According to wireguard itself the kernel-module based backend is more efficient/faster than the userspace implementation, and to use that it still requires root.

Adaway of course, and wireguard via the proper kernel module.

Mostly caching I guess, so less cold starting of apps

https://purelymail.com/

I think it depends heavily on how much storage you're allocating, if you allow uploading media that is. From what I've understood most of the bottlenecks are in DB operations so CPU and memory definately play a role.