As you've said, the device is not supposed to draw more than 100mA before configuration (and the host may refuse to configure a device asking for more current than the host is willing to supply). However, in the USB world, violation of many aspects of the standard is widespread, and hosts (or hubs) actually enforcing the 100mA-before-configuration limit (i.e. having an actual power switch) are exceedingly rare; OTOH, devices violating the current limit are relatively common.
So, for 1., I'd say, use it, but be prepared for various scenarios on VBUS - current limiting resistance, host switching off after detecting overcurrent after certain timeout and then switching on again, resulting in pulsing input, etc. Maybe the easiest solution would be to boost the VBUS slightly above maximum possible VBAT and then merge the two simply through diodes before dropping (or further boosting) it to the common supply voltage. But the design details are up to you.
For 2., if such a sophisticated power supply scheme is employed, you shouldn't count on full 5V/100mA either, as there will be inevitably losses. Nevertheless, the STM32 itself can comfortably run USB at a lowered clock out of a few tens of mA, simply dont use anything else - mainly external circuitry which consumes the 100s of mA - but the STM32, at lower clock, and in it only USB, while enumerating.
JW
