Extending UI and impersonating user for 3rd party calls

Hi guys,

I'm new to SharePoint development and currently trying to figure out the best approach/technologies to implement the following user experience:

1. For every authenticated SharePoint user I want to show a new UI element on every page (button/input field)
2. When clicking to that UI element, user should see an HTML UI loaded from my remote server.
3. That HTML should be displayed on the top of the page content
4. Calls to the back-end server should be done on behalf of the current logged user, so it will be possible to filter back-end response based on the user permissions

Which SPFx components do I need to use for that: webparts, extensions or both?

What about the impersonation? Can I create a SharePoint application that will redirect UI calls to my back-end along with a JWT so I could verify them, serve requests back to the UI?

Last, but not least: would it be possible to have everything above in one application for both SharePoint Online and SharePoint 2019 or would it be two separate apps?

Thanks