You're talking about the business side of software, not terribly well suited for this forum.
That being said, I'll play along a bit.
For the paperwork/boilerplate portion, you will need to get a lawyer, or start making friends with lawyers so you can ask them some of these questions in exchange for a beer (or whatever it is that lawyers drink). No amount of Googling will probably find you a good answer.
For the second point, server-side applications are exactly that, "server side", meaning they reside on the hardware in a closet somewhere, hopefully behind locked doors. Whether you are just putting software on someone else's hardware (the client's or some hosting provider) is yet another dimension to the business problem.
Finally, server-side Java apps don't expose their bytecode directly to anyone unless they have physical access to the computer and possess a login capable of viewing the file(s). There are bytecode obfuscation technologies that exist to make it as difficult as possible to reverse-engineer the bytecode to a usable source code. Some work better than others, the best make it more work to reverse-compile and modify than it would be to just write the software over from scratch.
Nothing is certain in software, but it helps to have really capable counsel.