You have a simple nginx webserver and it is listening on http port 80 for mywebsite.com.
You set up tor to also listen externally on virtual port 80 as a onion service for mywebsiteabcxyz.onion.
This can all live on the same web server at the same time. No reverse proxy is required. The key is that tor will always listen for a virtual onion service port ...
Thanks to @Steve, I ran the following:
systemctl cat firstname.lastname@example.org
Which gave me:
Let's say a bad node is actively scanning sites. If you have a link to example.onion/user404/data/page/example123.txt then yes they can see that because you linked to it. Also, if you turn on directory browsing in your web server and the node sees example.onion/user404 and can browse into those files and subdirectories then yes they could see that.
If you ...
I did the experiment suggested by @Steve in the comments. Spins up a simple http server on my Android phone, setup Orbot to expose it as a hidden service and written a script to periodically send request to the hidden service. Then just use my phone as usual. Browsing, streaming, play games and what not. And I did what I do usually: cycling, go to work, etc.....
I believe the traffic is encrypted 8 times (not including the TLS link crypto): 3 times along the client's circuit, 4 times along the onion service's circuit, and once more for the end-to-end encryption from the rendezvous handshake.
Client ─── A ─── B ─── C ─── Z ─── Y ─── X ─── Onion
│ ^ ^ ^ ^ ^ ^ ^ │