How to use Libsodium encryption (in PHP) in the most secure possible way?
No need to implement padding, as it's already available. See the second example of the libsodium-PHP module.
Partially-known plaintext has no implication on security, especially in counter mode where the encryption of a block is independent from the previous blocks.
Creating a valid signature requires the secret key. Ed25519 has a 2^128 security target. The best attacks known actually cost more than 2^140 bit operations on average, and degrade quadratically in success probability as the number of bit operations drops.
Nonces can be public. Keeping them private doesn't significantly change the security level. However, nonces should never be used with different messages and the same key. See this page for a discussion on libsodium and nonces.
Yes. This doesn't make the cipher stronger, but mitigates the implications of a leaked secret key. If you are encrypting very large data streams, the secretstream API will automatically rotate the keys for you.
Salsa20 already has a huge key space. A salsa20-in-salsa20 cascade would have no benefits, and would be twice a slow.
Libsodium does its best to avoid side channels. Leaks are more likely to happen in the PHP code.