Questions around how to build a public extension

Hello !
We offer a webservice that can be consumed through an API and we are trying to build a public application so that it can integrate easily in a hubspot workflow.
I have made my way around the documentation and the examples but I’m still struggling on some points.
1 - We would like our integration to deploy a card on the transaction view. This is achieve by us having to implement an endpoint in our side that returns the appropriate payload needed to populate the card. How can I authenticate this call from hubspot ? Our api relies on bearer authentication, with tokens related to organization accounts, but I don’t how I can achieve it here.
2 - I figured that I can access the hubspot api from my backend through the oauth authentication. Meaning that I am able to modify the schema of the hubspot account where the application is installed. Is it good practice to do so ? My use case is when the application is deployed, I want to add some properties to the Deal object, so those properties are accessible to the call for the cards data. If the application is uninstalled, how the clean up of those extra added properties can be handled ?
3 - Does removing the application removes cards AND workflows that are defined in the application ?