1) Qlik sense has no access control for mashups, you need to fix that for yourself
a) access rights to the app and the charts works in mashups too. Users without app access will not be able to open the app (which means they might get an empty mashup and probably some error messages)
2) yes, mashup user consume licenses
3) You need to build that yourself, with HTML objects and probably some library. You also need to make a serverside component to save the comments yourself.
Hope this helps