OK, after doing some research, I've at last solved the problem for LAN games.
The answers I found for my own above questions are:
Inconclusive. I tried to simply join a private match using mods using the "friends" feature but got stuck on a "Connecting..." dialog which would not resolve.
The proper location for usermaps on the gameserver is in "storage/iw5/usermaps". As far as I can tell, it need not live anywhere else.
Client-side files have no effect on what the host machine is doing at all it seems.
Yes, this is possible.
"http://[server IP address]/iw5/" is correct. If XAMPP is working through a particular port (I used port 80), then "http://[server IP address]:80/iw5/" is correct. This folder should contain a "mods" folder separate from "usermaps".
seta_fsgame should be set to "mods/bots" if you're running bots.
Now, as to what my issue was, so that others can solve the problem:
• XAMPP requires being run as an administrator. If you're not paying attention and launching it from the taskbar, you may not have launched it as an admin. My version of XAMPP (downloaded December 2024) displays a warning message about lack of admin privileges in the console dialog box when opened, but on my PC, this was half cut-off by other status messages so I'd initially missed it. Make sure you are running XAMPP as an administrator.
• Once you are running XAMPP as an administrator, you must download and install the Apache service. If there's a big red "X" in XAMPP near "Apache", you don't have Apache installed or it's not functional. This download took mere seconds from a button on the main screen of XAMPP and it was installed immediately.
• You must allow the newly installed Apache service through your firewall on the network you are running. To do this, go to Windows Firewall settings and look for services labeled Apache. Make sure all incoming and outgoing connections through Apache are allowed through the firewall. For me, editing the settings for Public networks was easier than for Private. Importantly, your network must match the classification of the networks for which traffic is allowed—I could not get my home network to work when configured in Windows Settings -> Wi-Fi as a Private network, so had to switch it to Public. If you have done this correctly, you will be able to navigate to "http://[server ip address]:80/iw5/" in a browser on your client machine and see the hosted files.
• To host your mod, navigate to the XAMPP folder on your C drive and look for a folder titled "htdocs" (it may be inside a folder labeled Apache, I can't remember). Your "iw5" directory (containing a "mods" folder and a "usermaps" folder) should live inside this htdocs folder. The files for your mod in your gameserver folder MUST MATCH EXACTLY the ones hosted in this htdocs folder or you will get the same exact "invalid file" error that you would if clients could not connect to the Apache server. This was misleading and sent me down a 10 minute rabbit hole of figuring out WTF happened when I updated the z_svr_bots.iwd file inside the gameserver mods folder without doing the same to the one hosted in htdocs. To diagnose this, check that you can still access the htdocs files on a client machine—if you can still see them on a client but you are getting an "invalid file" error, then the files in htdocs probably do not match those stored elsewhere on the game server.
So in conclusion:
• Yep, it's possible to host your mods and usermaps on the same machine that's functioning as your game server. You can probably also play on this machine simultaneously if it's powerful enough. I don't think this will work for anything other than LAN games unless you can have a URL direct clients to this folder (I'd be wary of doing this anyway).
• The gameserver folder for iw5 just needs a "mods" folder, and for Bot Warfare, the "mods/bots" folder needs to simply contain a copy of z_svr_bots.iwd with all the waypoints for any custom maps you wish to use. This z_svr_bots.iwd must be identical to the one located in XAMPP's htdocs folder.
• Usermaps on your game server only need to exist in the AppData "storage/iw5" on your game server and inside XAMPP's htdocs folder (again, these must be identical or you will get errors).
Hopefully this will help out anyone who has a similar problem in the future. My Mac wants to autocorrect "htdocs" to "hotdogs" and I'm done with that for now, lol. Happy to finally have this working again for LAN games and will have to keep an eye out for solutions to online games with friends.