Hi fa44,
1) please see this thread
#567
It's on the roadmap and should be done in one of the next releases.
2)
systemctl disable sshd.service
3) you can change the password for root with
passwd
There is only the root user active on runeaudio.
4) Encrypting your wifi key only means, that it is not human readable.
If some gets your encrypted key he has full access to your network.
https://wiki.archlinux.org/index.php/netctl#Passphrase_obfuscation_.28256-bit_PSK.29
You can encrypt your key with:
wpa_passphrase your_essid passphrase