Re #1:
You do not have to use an app.config file to configure NHibernate. I do all of my configuration "in code".
Assumes you have a static class with a private field _nhConfiguration of NHibernate.Cfg.Configuration and a private field _nhSessionFactory of NHibernate.ISessionFactory
Code:
_nhConfiguration = new NHibernate.Cfg.Configuration();
_nhConfiguration.Properties.Add("hibernate.connection.provider", "provider string");
_nhConfiguration.Properties.Add("hibernate.dialect", "dialect string");
_nhConfiguration.Properties.Add("hibernate.connection.connection_string", "your connection string");
//blah blah more properties...
_nhConfiguration.AddAssembly("your.dll"); //the dll that contains the .hbm.xml embeded resources.
_nhSessionFactory = _nhConfiguration.BuildSessionFactory();
I use the Nini configuration library to read xml configuration files with encrypted values.