(1) Which permissions are needed and why?
(2) Why is there a permanent notification shown?
A permanent status bar notification with the number of accounts being synchronized and the number of operations pending is shown to prevent Android from killing the service that takes care of receiving and sending email.
Most, if not all, other email apps don't show a notification with the "side effect" that new email is often not or late being reported.
The low priority status bar notification shows the number of pending operations, which can be:
(4) What is a valid security certificate?
Valid security certificates are officially signed (not self signed) and have matching a host name.
(5) What does 'no IDLE support' mean?
Without IMAP IDLE emails need to be periodically fetched, which is a waste of battery power and internet bandwidth and will delay notification of new emails.
(6) How can I set a Google app password?
See here for instructions: https://support.google.com/accounts/answer/185833.
This will be easier after implementing this feature.
If you have another question, you can use this forum.
If you have a feature request or found a bug, you can report it as an issue.