Yes.
The Logon Locally logon right is required for all accounts.
Limited. The request can leave the Web server and access resources on a remote computer so long as the account exists on both computers and the passwords are the same, or domain accounts are used.
No.
Any browser that supports client authentication certificates; this includes all current versions of Netscape and Microsoft browsers.
Yes.
IIS contains the mapping information as well as the account and password to map on to. Requires SSL3 or TLS 1 and the server configured to accept or require client authentication certificates.