While I would recommend the *arrs applications, Tiny Media Manager will do exactly what you’re looking for. The only downside is that if you want it to grab subtitles for you, then you have to purchase a yearly, but cheap, license.

This is a great update. I was surprised to find that server switching was much easier on iOS than it was on Android.

Your solution isn’t going to hurt anything. It might be overkill, but it will definitely work.

Ultimately, I think you only really need 2 of the solutions you mentioned.

1. A network wide DNS blocker, such as Pi-hole, to catch the majority of ads.
2. A browser ad blocker, such as uBlock Origin, for the rest.

Whoever is cheapest, with good coverage in my area.

I don't particularly think any one carrier will have any privacy advantage over another.

While I don’t have the solution OP is looking for, Bitwarden will provide the functionality OP is wanting.