Must a key for a HMAC-SHA256 digest kept secure?
My question: Is required to keep a key for HMAC-SHA256 secured or can I leave it with other user data as non-secure? 


If your goal is integrity and you use a 
HMAC, then it is mandatory to keep the key secret. A public key in HMAC would mean anyone can create valid tags for any message - and integrity is gone. 


  When hypothetical opponent gets the key, is it possible from HMAC-SHA256 digest restore original encryption key? 


No, it should be impossible to find the key from any HMAC value (that would contradict the security definition).