No.
The Logon Across The Network privilege is required for all accounts.
No.
Yes. The certificates are held in Active Directory.
Any browser that supports client authentication certificates; this includes all current versions of Netscape and Microsoft browsers.
Yes.
The mapping is automatically performed by Active Directory; there is no need to perform any password administration. Requires SSL3 or TLS 1 and the server configured to accept or require client authentication certificates.