Use a decent VPS instead of trying to host off a residential internet connection behind 47 layers of NAT and you don't have to worry about 90% of that stuff

i.e. use the right tool for the job

if they use TCP, you can, sort of, but any client that wants to connect will need to use Cloudflared

https://developers.cloudflare.com/cloudflare-one/applications/non-http/arbitrary-tcp/

you can skip the Cloudflare Access, probably (I've never tried any of this myself)

It's safe unless you run an exit node. All my VPS's run tor relays (mostly bridges) except for the IPV6-only servers where the support still isn't there. In my opinion all VPS's should be running Tor relays unless you have a specific reason not to (like if you have less than 1GB RAM you probably shouldn't). All the documentation is on the Tor website. Read up & decide if you want to run a normal relay or a bridge and follow the instructions accordingly.

As an alternative to (or in addition to) a relay/bridge, you can also run one or more instances of Snowflake Proxy which is a special type of Tor on-ramp that doesn't require running a full Tor instance, making it more suitable for low-RAM systems.

.UK is a weird TLD. For example, transfers between registrars are free (you don't have to extend the domain by a year are transferring), and there's a "push" transfer system instead of a "pull" system. You also have the ability to do certain management of the domain through Nominet instead of your registrar. Unfortunately, none of this seems to work very well and it took me months to successfully transfer my .UK, I even tried using Nominet's paid transfer option to force the issue and it still failed over and over (although I always got a refund). Eventually it just worked for no apparent reason.

.win is fine. It might be on some extremely aggressive spam filters but it's unlikely to affect you much.