You can tunnel over SSL with stunnel. TCP latency can be brutal though.

Looks like this happened:

OpenSSH server has had built-in support for WebAuthn keys since 8.2.

What type of key do you have. Yubikey 5 supports multiple protocols including some you can use with SSH:

• Multi-protocol: YubiKey 5 Series is the most versatile security key supporting multiple authentication protocols including FIDO2/WebAuthn (hardware bound passkey), FIDO U2F, Yubico OTP, OATH-TOTP, OATH-HOTP, Smart card (PIV) and OpenPGP.

SSH would need to implement webauthn to support FIDO.

I like S3 because I only pay for what I use and it has auto storage tiering.

You should name it Hawk, so people can call it Hawk-Tui.

I run Emby and MythTV on a Beelink Mini PC. It is a little pricey compared to some of the options you mentioned but not by too much. It works really well and is very quiet:

https://www.amazon.com/Beelink-SER5-5560U-500GB-Computer/dp/B0B3WYVB2D

Yes, you can configure non-router DNS in your DHCP server or you can manually set DNS on individual hosts. For a VPN you want to make sure the VPN connection has DNS manually configured.

If you have your router setup to resolve DNS, which is common, then while the VPN is active if you use your router for DNS, your router will be sending queries with the sites you visit from your real ip address to your DNS provider.