I can help you with your first question but not the rest since I didn’t use their boilerplate when making my extension and don’t use Docker.
But for question 1: You can’t use the standard OAuth that you’d use on a third party website but they do provide a way to allow user to share their identity.
Check out: https://dev.twitch.tv/docs/extensions/#json-web-tokens-jwts and https://dev.twitch.tv/docs/extensions/reference/#onauthorized-functionauthcallback
Also make sure to enable the Yes, I would like my extension to request an identity link. in the dashboard in the Extension Capabilities tab.