How about creating your own LAN within the untrusted network?

Something like an inexpensive OpenWRT router would do fine. Connect all your devices and the server to the router. They are now on a trusted network. Set up Wireguard on the OpenWRT router to connect to Proton so that your outbound traffic from all your devices is secured.

Yes indeed. Everyone arriving goes through immigration, collects bags, clears customs; and only then may proceed to the exit, or recheck bags and go back through security to catch a connecting flight.

The only exception is if you originated at a pre-clearance airport and did the immigration stuff before departure. But that means you still need a visa. And it’s only at a handful of airports in Canada, Ireland, UAE and the Caribbean.

In the US, if you land, you must pass through immigration.

At least I’m not aware of any airports where there is an international terminal like you find elsewhere in the world. Ours require entry to the country even if you are connecting to another international flight.

Edit: yep, none have this.