This would be done either via a reverse proxy (for public access via a domain you own, ex: service1.reticulatedpasta.com), or via a local DNS server if only being accessed via LAN without a signed SSL cert. For a reverse proxy, I use caddy which also manages SSL certs.

I’m not sure about cert scans, but ShadowServer is what I use for automated scans. They’re free and the scans are thorough: https://www.shadowserver.org/what-we-do/network-reporting/

Yes, this is fully opt-in. You have to manually choose images and submit them if you’d like to use them as training data.

Check out Trilium Next! It’s under more active development after development on the original project stopped.