A: 1. All 3 are supported, username/password is also support as well as social login with most OAuth providers like Facebook/Google etc
2. Yes
3. Yes, this would be a matter of creating a model to match what you want for example from your description:
type Note {
entries: [NoteEntry]
}
type NoteEntry {
note: String
file: File
}

you would not need to code this, the visual model builder shown in the screenshot would do something like this for you (we seem to have a mixture of developers and non-developers asking questions, not sure which you are so wrote it as a sample to give you an idea, ignore if it is meaningless jibber to you, the visual editor would allow you to achieve 3)

4. Sure, you can use the fine grained access rights to control visibility and access to any data