Typically, servers send a poke (a content-less hint) over a websocket to tell the client to sync. There are many services you can use for this, and since no content flows over the socket there is no security/privacy concern. See the integration guide for more information.

Replicache also polls at a low interval (60s by default) in case the poke mechanism fails or for applications that don't require low latency udpates. You can adjust this using the pullInterval field.

No problem. You can implement the integration points as serverless functions. Our samples are all implemented this way.