I'll leave the rest for harshil and shk to answer.

2. Currently, we follow an auth+capture model. Our authorization is completely client-side, which means it can be performed in a browser. However, to make sure that others cannot use the same code as yours to authorize payments, captures require you to have a backend of some sort.

4. Currently no, but we plan to do this in the future.