1) That is correct, you can have up to two administration nodes and up to two monitoring nodes in any deployment. However, it is not mandatory to have a secondary administration node nor a secondary monitoring node. No you can't have both administration nodes acting as primary PAN at the same time, one has to be the primary and the other has to be the secondary.
2) Same as above, you can't have both monitoring nodes acting as primary at the same time, so one will have to be the primary and another will have to be the secondary.
3) To have the PAN auto-failover enabled you have to have at least three nodes in your deployment. In that case yes PAN auto-failover can be enabled and the node that you will configure to check on the PANs will instruct triggering the auto-failover if the primary PAN is not available. However, please keep in mind that in ISE auto-failover there is no preemption which means when the primary PAN comes restores from its failure it won't become the primary PAN again, instead it will stay as the secondary PAN until you promote it manually to become the primary PAN again.
Cisco Identity Services Engine Administrator Guide, Release 3.2 - Deployment of Cisco ISE [Cisco Identity Services Engine] - Cisco
