How can I disable the automatic restriction on root password login via SSH in PVE’s Cloud-init, and how can I enable automatic disk expansion on startup?
This is not governed by PVE's Cloud-init, but by the underlying image you are using. For example Debian currently restricts root access & also any password authentication by default.
To enable these you will need to manipulate the underlying image you are using. See here on a tutorial I recently posted how to do this on a Debian Trixie cloudimage (debian-13-genericcloud-amd64.qcow2).