Do I need to purchase a commercial license or obtain any additional authorization?

No, you can use and deploy code-server however you wish.

Are there requirements or considerations related to user scale or concurrent usage?

The base requirements we have for code-server are 1 GB of RAM and 2 CPU cores, so I would use that as a starting step.

I think the points here are good in general: https://coder.com/docs/tutorials/best-practices/scale-coder#workspaces-per-node (technically this is for Coder, not code-server, but from what I can tell Coder might be doing what you are trying to do, or is similar at least).

Should I perform extra security hardening (e.g., network isolation, stronger authentication, per-user data separation)?

With Coder, we run code-server in separate Docker containers on a single node and I think this is probably the ideal way to do it. If you need to run multiple instances without containerization, I would run them as separate users and listen on sockets instead of ports.

The built-in password authentication should be OK, but personally I would put something in front to handle auth in a case like this, ideally something that unifies with whatever else you might be building (in our case, Coder handles the auth).

Is there a recommended deployment architecture for commercial or production scenarios (e.g., Kubernetes, multi-instance, load balancing)?

I think generally the recommendation would probably be Kubernetes (we do recommend it for Coder), but there are no official recommendations for code-server. As for the rest, it will really depend on your needs I think.

Does code-server support running custom builds of VS Code compiled from modified source code?

No, firstly each version of code-server only supports a specific version of VS Code. The reason for this is that our patches will generally not cleanly apply from one version to the next, so supporting multiple versions is simply not possible unless we also maintained separate versions of the patches.

It might help to think of code-server less like it "bundles" VS Code and more like it forks VS Code. You might be able to swap the underlying VS Code and the patches will still apply successfully, but there is no guarantee.

Secondly, you would have to swap in the actual source code, so our patches can apply. This makes building code-server off something like Cursor impossible since Cursor's source is not available (at least not last I checked).

Are there documents, examples, or recommended workflows for making custom VS Code builds work with code-server?

Not as far as I am aware. I think generally I would recommend that your custom VS Code build targets the same version that code-server targets, and it should be mostly OK unless you modify an area that one of our patches also modifies. If you can, it might make the most sense to maintain your custom VS Code changes as patches in a code-server fork alongside our own patches.