1.The plugin should probably have its own table To manage the process.
User_id | hash | hash_type | progress_status
2.This kind of plugin will introduce additional overhead for all login. But it is not that bad.
And it may be worth it for the extra convenience to the end user.
3.The plugin should be disabled after the majority of user base finalized their login.
4.Depends on the system you are migrating. You might need to implement different hash algorithms and be aware if “salt” was used.
5.You will have to keep track of migrated users and only perform the additional check on their first login. If the user reset their password the plugin will not get involve in any future login of that user.
I am not sure what is the best practices to introduce custom fields to built in tables on discourse