clientSecret is NEVER exposed
Cost/scale is a short answer
Yes the streamChange webhook which’ll give you the game ID, then lookup the gameID against the hexlix API.
This will account for any changes to the Game Art or the name of the game. This appears to be what you are already doing with twitchClient.helix.games.getGameByName but you need to switch to using getGameByID if this library you refer to supports it.
Correct it would have to be on a “real server” that is web accessable. Sure you could open a port in your firewall, but that is NOT advised or suggested.