Only other piece I would add to your great list: have at least one on-site and one off-site backup of your password manager, you’re 2FA codes, and your data.

Can you explain the VPN part a bit more? What do you mean with discretion here?

Nextcloud + regular filesystem sync works great. I am just storing my vault in a synced folder.

But you would need to host it yourself if you cannot pay for a service like Hetzner Storage Share.