I wouldn't worry about security with the PIX behind the 3660 I would jsut built a Access list to keep people out of the router block Telnet and maybe ICMP

You should not need a new activation key unless you want to use IPSec or other new features but if you do contact your VAR and they can help you for a Fee of course.

You Can use a local DIrector or some other type or redirector and If you get a product that is smart enough you wont lose reduntancy

http://www.cisco.com/warp/public/cc/pd/fw/sqfw500/prodlit/pix22_ds.htm this doc should help

you need to configure the H.323 Fixup Protocol I use NAT and PAT and by configuring the Fixup protpcol I was able to use Netmeeting thought the FW