Yes. You should always impersonate the client so the OS can make appropriate ACL checks for you.
No. You can make many access control decisions by looking at the client's token (looking for a particular group as in role-based security, for example). Use impersonation only when you have ACLs that are administered specifically to grant and deny access to clients.

because an asynchronous call may cause an unanticipated security context change
because any unanticipated thread switch due to a legacy COM component changes your security context
because some behavior can be surprising, for example, COM may or may not use the thread token as your identity for outgoing calls, depending on an esoteric feature called "cloaking"
all of the above
Whenever you decide to impersonate, realize you're in a somewhat wacky state, and be extra cautious.

will use connection pooling for scalability
will likely be anonymous because you won't usually have the client's network credentials
will time out when you stop impersonating

is a way to forward a client's credentials to a back end server
only works on Windows Server 2003
makes systems safer because the back end always sees the client's credentials
all of the above
The back end still must trust the middle tier to impersonate the correct client - there's no guarantee that the middle tier isn't handling a request from Alice, using credentials from an older request from Mary. It's a myth that delegation means you don't have to trust the middle tier.

is where a middle tier server is given blanket control over a client's credentials, and trusted only to use those credentials with a list of specified services
is where the authority only issues forwarded client credentials to a middle tier server for a list of specified services
requires the back end server to be upgraded to Windows Server 2003
Active Directory is in charge here, not the middle tier server. With constrained delegation, the authority will only issue forwarded credentials to a server "trusted for delegation to specified services only" for services in the allowed-to-delegate-to list.

is a new service that converts SPX packets into TCP packets
requires the client to be running Windows XP or greater, and have the latest version of the Kerberos SSPI provider installed.
allows a server to obtain Kerberos tickets on behalf of a client who might not be able to obtain them herself. The server is trusted to have correctly authenticated the client in some way.
Active Directory is in charge here, not the middle tier server. With constrained delegation, the authority will only issue forwarded credentials to a server "trusted for delegation to specified services only" for services in the allowed-to-delegate-to list.