This would be done either via a reverse proxy (for public access via a domain you own, ex: service1.reticulatedpasta.com), or via a local DNS server if only being accessed via LAN without a signed SSL cert. For a reverse proxy, I use caddy which also manages SSL certs.

I’m not sure about cert scans, but ShadowServer is what I use for automated scans. They’re free and the scans are thorough: https://www.shadowserver.org/what-we-do/network-reporting/

Yes, this is fully opt-in. You have to manually choose images and submit them if you’d like to use them as training data.