

Your new account will be online. Can access OneDrive and everything Microsoft Online offers. That means anyone with internet access can try to login to it so it has to be very secure.
Windows Hello can be used for local login. But I agree with you. I would love to be able to access my Keepassxc vault during the login process. But that might be hard to archive so better to use Windows Hello.
Configuration gui standard. Usually there is a config file that I am suppose to edit as root and usually done in the terminal.
There should be a general gui tool that read those files and obey another file with the rules. Lets say it is if you enable this feature then you can’t have this on at the same time. Or the number has to be between 1 and 5. Not more or less on the number. Basic validation. And run the program with --validation to let itself decide if it looks good or not.