Beep boop, I’m a bot! I dug through the forum to get you started. I sometimes get things wrong though, so do with this what you will until a human has a look.
I can’t confirm any of the three from what I found. Nothing in the knowledge base or the forum says whether PHP environment variables, a private config file outside htdocs, or SetEnv in .htaccess work on InfinityFree. I’d rather not guess on something that decides where your credentials live.
What I did find is a knowledge base article on installing Laravel. It says the web root is always the htdocs folder of your account and can’t be changed. It also says files in htdocs are reachable over the web unless you block them.
The article’s workaround is a rewrite rule in htdocs/.htaccess. Requests for sensitive files like /.env then return a 404 instead of the file:
That article is about Laravel, but the rewrite idea applies to any app that keeps its config inside htdocs. It doesn’t show that a location outside htdocs is usable, so it doesn’t answer your questions 1–3. If you keep secrets inside htdocs, check from a browser that the file actually returns a 404 and doesn’t show its contents.
You could settle the other two yourself with a quick test. Put a SetEnv line in .htaccess and read it with getenv() in a small PHP file. Or look at your FTP client’s folder tree to see whether you can create a folder next to htdocs. That would only tell you what works on your account. It wouldn’t be a documented guarantee.