1) It should be possible to wire an IDRATEK relay in parallel with the existing thermostat connection (call for heat). Then, as you suggest, you turn the existing thermostat to a low temperature (now can just act as a backup) and keep the heating set to ON at all times. The IDRATEK driven relay now acts as your thermostat albeit a more sophisticated one.
As you might already have gathered, the Cortex HVAC object does not have the traditional concept of timers. Instead it uses 24/7 set point profiles. That is, the heating (or cooling) is always under control. For the heating side you will probably have the profile set to a relatively low temperature overnight so that it is likely that the heating will in effect be off at night - but really this is now a matter of controlled choice. During the daytime you can do something similar, but people who install a properly sensorised system can then make use of the 'unoccupied' back off profiles.
If you want to go beyond the simple answer the next step is to consider controlled actuators for your radiators (if you have a radiator based system). This would then allow you to have independent control of rooms or zones.
For Hot water it depends a bit on how your existing system is plumbed and wired (various priority schemes), but you may be able to just have another relay across the timer output relating to the HW. You can then just have the HW timer permanently off and have the relay acting in its place.
In choosing the relay module for the heating demand I'd recommend that you either use an independent module such as the SRH, or if using a multichnannel module that none of the other channels are likely to be used for timed relay operations (at Reflex level not Cortex timed). This is because it is always best to operate this relay in a 'keep alive' mode. Meaning that if Cortex fails to update, the heating fails into the off state.
2) You can have IDRATEK button modules in the bathroom so long as the mains switching itself (and anything that might be construed as connected to mains) is done outside of the danger zones or well inaccessible to anyone in those areas (including indirect conduction around a physical obstacle via water). So a DRB or SRH is not a good idea but a QBI, DBI or DFP is ok. Or you can have a third party device connected to a digital input. But its not uncommon to have buttons outside and motion/light level sensing inside. In a well sensorised installation it shouldn't be necessary to touch the button regularly.