#4 favor async/await and Promises in any modern codebase, this has been in Node for a while without a flag.
#5 is express specific... aside: if your API is meant explicitly for your front end, I would reverse proxy a slice for `/api` from your front end host if you can. This does mean you won't be expressly static-only for the front end, but you do avoid a class of headaches and can do other stuff such as SSR, donut rendering and other caching or output customizations.