Salt and pepper at both client and server sides?
I think the detailed approach you have given can work. To address your specific point:


Rule of thumb: No md5 is never okay, for anything.
I'm not sure what you mean but pretty sure that the answer is: No.
The order doesn't really matter although your point is correct and you should probably add field separators instead of just concatenating.


I think proposing this kind of change requires a consideration of the attacker model. Your connection should be secured by TLS and all this becomes moot.

You can do more advanced things, they are great but work a little different. Maybe looking Password Authenticated Key Exchange (PAKE) will give you some inspiration.