Security of HKDF when part of output is exposed
In a secure KDF, the output is indistinguishable from random. In particular, all the output bits are independent, so revealing some of the output doesn't give any indication about the other bits. 

Hugo Krawczyk's HKDF definition paper proves that HKDF is a secure KDF under some reasonable assumptions on the underlying hash function which SHA-2 is believed to meet (theorem 4).

With a 128-bit root secret, you only get at most 128-bit protection for anything based on derived material, even if you use a stronger algorithm. That's ok: 128-bit is generally considered unbreakable until at least 2030, and it doesn't get any better than unbreakable.

Allowing clients to pick arbitrary stanza-ids doesn't harm the server directly. It's just passing data through. It means that the server won't be able to use stanza-ids to meter communication, so you'll have to rely on some other means to avoid denial of service attacks (if anybody can submit data to your server, someone can upload terabytes that they won't be using, and you have no way to detect that).

Note that even if the server is unable to make a link between Alice and Bob through pure cryptography, it can make informed guesses by observing who uploads and downloads what data when. It'll take more than this part of the protocol to achieve some measure of anonymity.

I recommend using a proper authenticated encryption mode such as GCM, rather than building your own with AES and HMAC. You have less risk of an implementation mistake that way.