You could also route any calls to /api through authentication. However I am not sure if that can cause any problems. Is there a list of endpoints that need to be reachable for federation to work?

Never noticed anything in the last couple of weeks. I had one podcast missing new episodes because the schedule was turned off. But I might not have had it turned on in the first place.

ntfy and FreshRSS for me. Audiobookshelf recently joined and I am using it daily. (Inofficial probably the Arr stack though 😅)

They do allow to reply, simplelogin also has no limitation on reply count.

If it is just for email forwarding maybe a service like https://anonaddy.com/ or https://simplelogin.io would work. Catch-all is even included in the anonaddy free plan as that is something you actually do not want to have enabled 😄 For your custom domain you have to have the lite plan at least though.