Lots of steps to “figure it out”. Could’ve just pinged the hostname.

Not a big secret. Pretty sure they even announced it.

As you suspect, only during the sixty or so seconds that they are valid.

SMS-based codes tend to be longer lived.

They’re useless without your other authentication factors, e.g. login, password.

None (by Lemmy), as Lemmy doesn’t actually request the image (that would be proxying). Your browser requests the image directly by URL. Lemmy, technically, doesn’t even know an image exists. It just provides the HTML and lets your browser do the work.

While ARC is interesting it is available for neither Android or Windows, which was OPs requirements.