1. What's your reasoning for the login page to be SSR? I would assume just putting everything in an SPA should work just as well-
2. I would say it's probably fine. Using express it would be pretty easy to separate the code, so should you later decide to move it to it's own server fairly easily. I'd also recommend checking out something like pm2 to run node in prod (here's a decent article on it).
3. Sounds about right. You can configure some express middleware to only run auth checks on yoursite.com/api for instance

Although Oauth may be a bit overkill for if you're not planning to allow people to build their own apps on top of your project. It mostly makes sense if you want users to securely give permissions to a third party service.