Read the docs please. You should not call logOn() inside of the disconnected event as steam-user will handle reconnecting automatically. Checking the steamID property is how you can tell whether you're currently logged in or not.
Yes, getExchangeDetails makes a Steam API call (specifically, GetTradeStatus). Generally speaking, anything that has a callback makes a network request.
No, there's no built-in mechanism for handling rate limiting. You'll need to do it yourself.
Yes, this is the only way to obtain web cookies if you have a refresh token for EAuthTokenPlatformType.SteamClient. Other platform types can get cookies via steam-session.
You can still use a proxy the same way you did before with steamcommunity, but you're correct that the login() method no longer works if you do. You need to use steam-session with your proxy and call setCookies on steamcommunity, passing your proxy to both.
Trades containing CS2 items are not returned by the WebAPI when using an API key. You need to use an access token instead. You can get one using steam-session, and you provide it like this:
https://api.steampowered.com/IEconService/GetTradeStatus/v1/?tradeid=123456&access_token=eyAid...
Have you acknowledged the modal about trade protection? You need to do that or call acknowledgeTradeProtection in node-steamcommunity once per account to be able to trade.
It's based on whether Steam reports if you have a wallet or not. I believe it becomes true the first time you fund your wallet (and thus set a currency for it).