This is easy with Traefik. Just create one entrypoint for public services in addition to your existing entrypoint. Then point Cloudflare at your new entrypoint and add services that you intend to publicly expose to that entrypoint, then add everything else to the other entrypoint that isn’t connected to Cloudflared
Not that I’ve found. Plexamp + Sonic analysis (and everything that comes along with that) is one of the major factors that keeps me committed to Plex as my primary media server. I run Jellyfin alongside, but the music experience (as well as other things) just can’t stand up to Plex yet