I did exactly this for my startup (https://easy.green). I'm very happy with this setup so far, with the code embedding feature for on premise delivery. I had to disable the worker mode though, it caused issues with uncommon features in the ORM.

For lightweight JS interaction, I prefer the Stimulus controller approach that doesn't mess too much with your HTML, and doesn't try to sell you "components"...

https://stimulus.hotwired.dev/

I use this with Mozilla SOPS to crypt sensible yaml configuration values stored in a Git repo. Works great, fast, and keys and payloads are short.

I don't totally agree with you on this. Telemetry on open source extension is public and opt-out, but it is neither on the MS VSCode builds or proprietary extensions. Additionally, I just can't believe that Microsoft uses telemetry data just for bug fixing, even without evidences, but that's only my opinion.