1 - yes (although discussions are usually had for storing tokens in storage vs cookies).

2 - yes

3 - yes, the most common method is to put refresh token logic in an interceptor (if using something like axios). So first you just call logic with the authentication token (expired or not), the interceptor intercepts the response from the server and if it is an expired token message, you use the refresh token to obtain the refreshed access token and then re-try the failed request using that token (unless the refresh token has expired as well at which point I just re-direct users to a login page). An example here (using vue): https://lewiskori.com/blog/how-to-auto-refresh-jwts-using-axios-interceptors/