as i know, the captcha is universal, if you have custom plugin for login, is easy to integrate.
not possible at the moment, but can be done via a custom plugin.
yes, it's a native feature, per default is 10 attempts, it can be changed from config file (Blesta.max_failed_login_attempts).
just rename the client prefix from routes.php file to any new name like 'area' so the link will become /clients/area/