This also puts a lot of trust into the OS. How do you know the OS is supplying you a correct version of the software (and not one slightly modified to benefit the creators?)

Depends, what are you planning to mine?

(All the rates i'm posting are stock and not overclocked)

If you're going to mine ETH, the best bang for buck would be the AMD RX 580 - it gives you around 22 mh/s, your next best bet is the NVIDIA 1070 - gives around 27 mh/s.

I would recommend you go with around 4x RX 580's (don't forget you still need a MOBO, PSU, GPU risers, etc), so take that into account.

I would personally go for 4x or even 8x rx 580's.

You can think of Bitcoin as digital cash, that isn't distributed by any central authority.

To get everyone to agree on a state, each transcation must be mathematically verified by each participant on the network. So as long as there is more honest participants than malicious ones n the network, the funds are kept intact.

The underlying technology behind Bitcoin is blockchain, which can be thought of as a slow database.

You do know want to give away the exchange's user account's private key. Because if you do that the user could potentially squander you out of some bitcoins (e.g. setup an open order and then transfering away all bitcoin before order is completed)

Full node is when you know your data is correct. An API is good if you're providing that API otherwise you're relying on a 3rd party to provide you correct information (which is something we don't want in a trustless world).

The server can be anything, doesn't need to be ubuntu.

Yes that is an API, but a more common use for an exchange API would be to retrieve funds of specific accounts (to see if a user deposited money into it or not).

E.g. to get the data of address `1M2n7X42iGAheNSNCNq5nfGq5Z3JeRBw8H` we could just go to this link: https://insight.bitpay.com/api/addr/1M2n7X42iGAheNSNCNq5nfGq5Z3JeRBw8H

You'll need a standard database to get started with (e.g. PostgresSQL/MySQL).

This is needed to track open/close orders as well as the private keys associated with each user account (private keys are randomly generated).

Then to verify the balance of those user accounts, you can either use a full node or communicate with an API (e.g. blockchain.info)