I'm not too much involved in the security area, but perhaps the following remarks are useful for you (although e.g. my reply to 1. is not more than the "competent programmer" solution you already mentioned as an option):
Ad 1. You can use SQL: "HANA_Security_GrantedRolesAndPrivileges" (SAP Note 1969700) with a properly configured "Modification section" to check for privilege and role assignments.
Ad 3. The database trace (SAP Note 2119087) can be activated for certain authorization related traces (e.g. authentication or xsauthentication). Also an "authorization" trace is available there. The trace information will be part of the normal service trace files.
You may also have a look at SAP Note 2159014 which is supposed to be an entry point in the world of SAP HANA security.