Victoria

I think SFTP would work plenty. On linux you can use rclone to mount it, and Android has many file managers that support it (personal favorite is Total Commander with the SFTP plugin)

You could also certainly host a full Nextcloud instance, but it might be a bit overkill

You can use a DNS challenge to show you are in control of the domain without having anything exposed to the net. Essentially LE gives you a special value you have to add as a TXT DNS entry. LE will check if this record exists for your domain, and gives you a certificate, no public IP involved. This even allows you to create wildcard certificates.

I use sendgrid, it only requires some DNS entries for Domain Authentication. Also regarding the catch-22, if you use Cloudflare for DNS, you could use their email routing to forward incoming mails to Gmail