Wero is replacing a lot of them soon

Have a look at Thingino. Comes with wireguard built in. No idea about the solar stuff though. Maybe run it off a generic 5V solar solution.

If possible: do that on company time. Let the boss pay for it.

Care to elaborate on ‘the risks of flatpak’. If you are refering to the practice of people using unofficial flatpaks: Yes I think that poses a certain risk because you are adding an additional party to your threat model.

Export your OTP database to an (optionally) encrypted file on a USB stick and put that in a lockbox/somewhere safe. If encrypting the stick/file: make sure you use a memorized/written down password.

You can set up a VPS and tunnel that to your minecraft server using wireguard some iptables magic if you’re into Linux.