Yes, speed would be much slower.

Yes, you can host a normal website through tor.

AFAIK tor websites (onion service) doesn't require exit node, and no one knows your IP unless you are unlucky enough all nodes you connected are controlled by same entity.

I am pretty sure you can set your own DNS server in Android.

I think most up-to-date OpenWrt routers can do later (with normal, unencrypted DNS requests), see https://openwrt.org/docs/guide-user/firewall/fw3_configurations/intercept_dns.

The model you mentioned (Flint 2) is supported by OpenWrt.

route ipv6 dns to a destination of my choice

Does this mean setting custom DNS server (so devices using DHCP picks up what DNS server you want them to use) or intercept DNS requests (MITM or use firewall rule to drop outbound 53 port requests)?

One thing notable of Sierra Forest is that the CPUs don't have SMT (only 1 thread per core), so in theory it doesn't suffer from speculative execution attacks.

Epyc CPUs still provides more PCIE lanes, which is crucial for GPUs.

asyncio provides "cooperative concurrency" for python.

Lets say you need to download 10 webpages in python, someone might do

result1 = requests.get(...)
result2 = requests.get(...)
....
result10 = requests.get(...)

Down side is that each requests.get() blocks until HTTP request is done and if each webpage loads in 5 seconds your programs needs 50 seconds to download all pages.

You can do something like spawn 10 threads, but threading has it's own downside.

What coopertive concurrency does is allowing these coroutine(tasks) that can tell Python to do something else while a function is waiting for something.... I think it's the best to read some Python examples. https://docs.python.org/3/library/asyncio-task.html#coroutines

examples that solves requests.get() problem with asyncio but it's probably better to use libraries that builds around asyncio.

ASUSTOR has NAS that can have up to 12 NVME SSDs (but speed is very limited by PCIE lanes).

NVME SSDs are still very expensive compares to HDD.

NAS that have many HDD bays are expensive but designed for easy setup and easy management.

Fractal Design Define 7 (XL) can have up to 18 HDDs by design, but then you will need to search for PCIE to SATA cards and PSU that have many SATA connectors (for example RM850x/RM1000x) and Molex to SATA cables.

FSP CMT370 is a much cheaper case with up to 3.5" HDD *9 or 2.5" SSD *10 but it's not on amazon, it probably doesn't sell to western world.

SAS drive enclosures (and SAS cards) are also an option, but the cages might be very loud because they are designed for servers that also are very loud.

I once saw an advertisement that is negative towards house building company, links to a news article.

Important things about dual booting:

1. Configure your Windows to use UTC time https://wiki.archlinux.org/title/System_time#UTC_in_Microsoft_Windows

2. Disable "Fast startup" in Windows (can possibly cause hardware issues if not disabled and it really doesn't improve things in computers with SSD)

What do you recommend I do about disk partitions?

I recommend separate EFI partitions while dual booting, I haven't seem issues with my separate EFI partition setup yet.

If Mint provides Btrfs filesystem I personally recommend looking into timeshift (snapshot software that can be setup to automatically snapshot your computer).

Is disk encryption straightforward?

According to Linux Mint forum, you need to choose an option in "Advanced features" while going through installer, that seems straight forward

Is cloud storage sync straightforward?

Don't have experience with this but I can tell you: While rclone supports bi-directional sync, you need some setup for make it run periodically.

Should I just use apt to install software?

In the end you have to give trust to someone, I think it's fair to say if you already choose Mint you probably trust whatever options comes with Mint more than 3rd party options (but is it theoretically possible that backdoored program exists in Mint repository? of course yes).

While my solution isn't perfect (if someone key logged my computer I am very screwed), I think it's better than (1) have a much higher chance of losing my 2FA tokens altogether (2) put all hope on Bitwarden being not compromised