Technology

First, you should check if your exact model is supported by the ROM you're trying to install. I could only find this build on the LineageOS site, not sure if that's the exact model. If you can't find a ROM for your exact model you're out of luck. ROMs for other devices won't just work.
GrapheneOS is afaik only built for Pixels, so no.

Current best practice recommended by the devs is using the LineageOS recovery instead of TWRP. The main reasons being up-to-date support for the encryption used by Lineage and OTA upgrades.
In that case, you'd also want Lygisk instead of Magisk, to automatically have root reinstalled after every OTA upgrade. (Lygisk is a fork of Magisk, you get the same functionality otherwise)
Edit: As pointed out by aleph below, you only need Lygisk if your device is A-partition-only. If your device has AB-partitions, simply run the update and BEFORE REBOOTING, go into the Magisk manager and reinstall to the other partition. To check if your device is A-only or has AB-partitions, you can use this Treble checker. If "Seamless System Updates" says "supported", you have AB-partitions. Otherwise it's A-only.

You can hide root for most apps if you use the right modules. The first one you'd want is Universal SafetyNet Fix. With this installed you'll pass basic SafetyNet attestation in most cases.
The second one is Shamiko, a better implementation to hide root from apps. Install that, go to the Magisk/Lygisk settings, Enable zygisk and disable enforcing the deny list, but do select the apps you want to hide from in the tab below.
Shamiko will take over the blacklisting instead and hide you from apps.

For F-Droid, I'd recommend just installing that manually plus downloading the F-Droid Privileged Extension and installing it through Magisk.
For Aurora Store, you can get a similar privileged extension here.

Good luck and happy rooting