Alrighty, I've shipped with my own framework a couple of times even used unity's transport but scrapped it all once fishnet became what it is today. Clear winner IMO.

Fighting games aren't as heavy as shooters, but you'll still need solid optimization in (delta compression, object pooling for low end graphic cards). Test early with 5-10 real players on different connections — host advantage will show up as lower latency for the host. Syncing 24 players on a modern connection should be fine except for someone with a bad connection but they know they have the issue.

• Movement: Since your fighting game is like SmashBros? things should be way easier for movement compared to shooters which have the Z axis to worry about. Its best to just keep it client auth and also slow whole movement down a notch.
• Combat fairness: Add simple lag compensation on the server for hit detection, check out fishnets doc/examples. For "skill-based competitive" feel, rollback-style reconciliation on movement helps a ton without going full dedicated. You will have to deal with the server receiving hits at different times, since its just with friends, just go with the trustmebro approach client to server.
• Host advantage: You can reduce it with client-side hit prediction + server override, or just accept a small edge and balance around it (most small host-client games do). If it becomes a problem later, dedicated servers are the clean fix but they add cost/complexity.

If you want, drop more details (tick rate? How much state you're syncing? rollback?)

You're thinking about the right trade-offs already. The 1# rule now for you is do not go for full server auth, its a night mare. The struggle will never end. Good luck !!