Awesome! Can you put it on Github?

On %CSP.Session
/// Specifies the timeout value for the session in seconds.
/// <P>If no user requests are received within the specified time period,
/// then the session will end. The default value comes from the CSP application
/// setting for the application that the session starts in which is set in the
/// Cache configuration manager, this is often 900 seconds or 15 minutes.
/// Note that if you start a session in one applicaiton and move to another application
/// the AppTimeout will not be changed to the new applications timeout value, if you wish
/// to modify this when the application changes you can use the session events 'OnApplicationChange'
/// method.
/// <P>For no timeout, set this property to 0.
Property AppTimeout As %Integer [ InitialExpression = 900 ];
You can also specify the timeout for your App as a whole:
 

<your server ip:57772>/csp/sys/sec/%25CSP.UI.Portal.Applications.Web.zen?PID=%2Fcsp%2Fuser

Since you didn't specified which service you're using it's hard to simulate your doubt.

However I did a quick research and noticed that 'padding' actually refers to OAEP, this could be the method you want to use to encrypt. I'm not sure though.
/// This method performs RSA encryption as specified in
/// PKCS #1 v2.1: RSA Cryptography Specifications, section 7 Encryption Schemes.
/// <br><br>
/// Input parameters:
/// <br><br>
/// Plaintext - Data to be encrypted.
/// <br><br>
/// Certificate - An X.509 certificate containing the RSA public key to be used for encryption,
/// in PEM encoded or binary DER format.
/// Note that the length of the plaintext can not be greater than the length of the modulus of
/// the RSA public key contained in the certificate minus 42 bytes.
/// <br><br>
/// CAfile - The name of a file containing trusted Certificate Authority X.509 Certificates in PEM-encoded format, one of which was
/// used to sign the Certificate (optional).
/// <br><br>
/// CRLfile - The name of a file containing X.509 Certificate Revocation Lists in PEM-encoded format that should be checked
/// to verify the status of the Certificate (optional).
/// <br><br>
/// Encoding - PKCS #1 v2.1 encoding method (optional):<br>
///     1 = OAEP (default)<br>
///     2 = PKCS1-v1_5<br>
/// <br><br>
/// Return value: Ciphertext.
ClassMethod RSAEncrypt(
Plaintext As %String,
Certificate As %String,
CAfile As %String,
CRLfile As %String,
Encoding As %Integer) As %String
{
}

I just posted my implementation on Git for analysis.
https://github.com/rfns/cache-fp-poc

As long as there's an abstract API for parsing, lexing, transpiling and serializing. It would be possible to even port any FP or FRP language to Caché.
Since you demo'ed JavaScript, it seems programming on a functional way could be possible if we could simply pass methods as parameters.
Well, that's actually the core rule for a language that supports functional paradigms.
Since there's no current support for such paradigm. Maybe we could wrap it using indirections or xecutes?
 

set array = []

do a.%Push({ "value":  "some value to be replaced" })

set result = ##class(FP.Functor).%New()From(array).Map($this, "...ValueWithIndex",  scopeParam)
Method ValueWithIndex(item As %DynamicObject, index As %Integer, scopeParams... As %String) 
{
    // Second core rule: always keep it pure. Map should always Clone the item, which could be implicit for Map.
   // But for this case I'll demonstrate it manually.
   
      set clonedItem = item.Clone() // Or %ConstructClone if possible.
      set clonedItem .%Set("value", "modified with "_index)
      return  clonedItem
}
Please note that this still doesn't provide the possibility to use high-order functions. The closest we could have I think is embedding subroutines within your context method. Which could also be reproduced as:
 

// Can also be Method.

ClassMethod YourContextMethod() As %String
{

set scopeParam = "blahblahblah"

// Now assume we're using %ZEN.proxyObject. Omitted for brevity.
set result = ##class(FP.Functor).From(array).Map("$$HOMapWithScopeParam",  scopeParam)
HOMapWithScopeParam(result, item, value, scopeParam...)

  // Now Implicitly cloned into result param.
  set result.value = scopeParam(0) // Could be improved.
  quit result
}
Nope, I forgot that procedures are exclusive for the subroutine that's defining them. 

I did a little experiment and here's the result:
  ClassMethod testing(item)
{
  set array = ##class(%ListOfObjects).%New()
  for i=1:1:10 {
    set proxy = ##class(%ZEN.proxyObject).%New()
    set proxy.value = i
    do array.Insert(proxy)
  }
  
  set DoubleItemValueSumTwo = $classname()_":DoubleItemValueSumTwo"
  set Odds = $classname()_":Odds"
  set BiggerThanFive = $classname()_":BiggerThanFive"
  
  set result = ##class(FP.Functor).From(array).Map(DoubleItemValueSumTwo).Filter(Odds).Every(BiggerThanFive).Result()
  quit result
}
ClassMethod DoubleItemValueSumTwo(
item As %ZEN.proxyObject,
i)
{
  set item.value = (item.value * 2) + $random(2)
  quit item
}
ClassMethod Odds(
item As %ZEN.proxyObject,
i)
{
  quit (item.value # 2 '= 0)
}
ClassMethod BiggerThanFive(
item As %ZEN.proxyObject,
i As %Integer)
{
  quit item.value > 5
}
There is space for a lot of improvements I think. It's not exactly what you would call a performatic implementation. But that's a beginning.

set key = ""
set var1 = "code2"
for  {
    set key = $order(^myglobal(key), 1, list)
    quit:key=""
    if $listget(list, 1) = var2 kill ^myglobal(key)
}

Use $order to iterate over global subscripts.

You might want to check this out.
https://community.intersystems.com/post/how-do-i-get-list-files-directo…

Are you using Dynamic SQL (%ResultSet, %SQL.Statement)?
http://docs.intersystems.com/latest/csp/docbook/DocBook.UI.Page.cls?KEY…
Are you using embedded SQL or named queries?
Then it's the same as Oracle. Ex: :parameterName

http://docs.intersystems.com/latest/csp/docbook/DocBook.UI.Page.cls?KEY…
Check the "Configuring an ECP Application Server" section. However, I advise you to read everything.
Remote databases should be created on the client instance (A). They represent the connection with the local database on the server instance (B).
If you follow the steps from the guide, when creating a remote database you'll notice that the wizard will ask you for a server, that's where you should select the ECP server you just defined.
Now create a local database on the client instance if you need to store something on it (like, let's say... code). And finally create a namespace, this is where you can define where to use local or remote database (GLOBALS AND/OR ROUTINES).
CAUTION: If you configure globals to use the remote database, any changes you do on the client instance will reflect on it's provider counterpart. The same applies for routines.
EDIT: Answering your question. No, as I far as I know, using this method you can't have more than one remote database for each global or routines. But I think you can workaround it by defining another namespace, from another remote database that links a local database on instance C and map what you want.
But you'll be responsible for dealing with name conflicts.

cls/My/Deep/Class.cls

I don't think subdirectories should be applied for routines, originally routines aren't supposed to have submodules or subpackages and dots might be part of their name. Also if you need some complexity, you wouldn't prefer using routines but classes to keep things organized.
 

I DO NOT recommend using src, unless you want to mix both back-end and front-end code. 
Or you want to keep the server code in a separated repository.
Here is a scaffolding based on React for better understanding.
my-app-project /
   package.json
    server
          cls
          mac
          int
          csp <- this is our build path, nothing should be added manually because everything is handle by the bundler.

    scripts /

         test.js
         build.js
        dev.js
   config /
         webpack.config.dev.js
         webpack.config.prod.js
         webpack.config.test.js
   src /

         components
               Header
                   index.js
                   Header.js                   
                   HeaderSearchBar.js
               Footer

                   index.js
                   Footer.js
                   FooterCopyright.js
                AppContainer
                    index.js
                   AppContainer.js
          containers
                App.js
           tests
               components

                  Header
                      Header.js                   
                      HeaderSearchBar.js
                  Footer
                      Footer.js
                      FooterCopyright.js
                   AppContainer
                       index.js
                   AppContainer

                              
You can use folders to separate both client and server codes inside the same project. You can even structure your project

using a monorepo approach if you want to keep multiple application modules together.
                  

Now since React will be using webpack's hot module reloading along with webpack-dev-middleware that builds everything within the memory, your Caché server should only work following SPA conventions and providing consumable data.
There's a catch though, whenever the developer builds a new version (using webpack.config.prod), it's mandatory to delete the older bundle and import the project back to Caché to keep the source in sync on the server and the project.
     

Try using BETWEEN.