Proxmox is good as a host OS, you'll set up a VM for docker and run your stuff in that.
It has a built in backup system to image your VMs and Containers, you can combine it with Proxmox Backup Server either in a VM or on another system for incremental backups and deduplication.
As far as Nextcloud goes I'm not surprised you had issues, their setup is weird, non-standard and very unstable in my experience. I switched to Syncthing long ago and it's so much better.
Sometimes you need a VM. They're not overkill, just useful for different things.
Examples; Running Windows, Running OSX, Passing through hardware to use isolated from the host (PCIe devices, USB, etc), Linux guests where you need a full kernel and permissions (for example to run Docker without issues caused by being nested inside a container).
VMs don't really have much more overhead than a container in most use cases too. For example a VM with debian installed uses about 30MB of RAM.
Maybe Intel AMT running? I'm not sure it can be disabled though.
It's just WIN + Spacebar, or click the keyboard layout icon in the taskbar.
I've never been able to get this one to work, it will say it can't detect speech even though I can hear it being played.
Many people use laptops and use other wifi networks or tether to their phone, both can expose you because of unknown firewall states or IPv6 being used.
There really isn't one that's a true alternative to WP.
There are plenty of nice static site generators, but those are significantly harder to use and not just drag and drop, they also don't have the huge plugin marketplace that WP does.
Everyone loves to complain about WP (rightfully so in some cases, it has its own problems), but will suggest alternatives that are nothing like it.
It's so much worse than WP though.
By default it should be configured to allow all outgoing, and block all incoming. That's perfectly fine for a desktop/laptop and you don't need to mess with it.
You can't really do that much outgoing filtering with a firewall that will be useful, because basically everything operates on port 80/443, and often connects to the same CDNs or datacenter IPs for multiple services.
Instead DNS blocking is a much more effective way to handle it, plus uBlock Origin in your browser.
Immich has been great, I've been running it for something like 1.5 years now I think.
I love that they clearly say that. IMO they should keep that notice around even later on.
Far too many people spin up some solution for photos or files, either selfhosted or some paid service, and use it as their only storage. Then they're surprised when data loss happens.
I don't use it on Android because I don't need sync, I need backups.
Photo backups are handled by Immich, and a general backup is done by the FolderSync app on a daily schedule over WebDAV to my server.