If going to the URI In a browser, it will just be doing an HTTP GET without a bunch of other parameters it needs, so I wouldn't be surprised by the 404. The URL looks correct though, it's described here:
https://learn.microsoft.com/en-us/entra/identity-platform/msal-authentication-flows#constraints-for-device-code

To answer question 2 - Microsoft have done this help article here:
https://learn.microsoft.com/en-us/partner-center/account-settings/find-ids-and-domain-names#find-the-microsoft-entra-tenant-id-and-primary-domain-name

but try the Disco urI, i.e. :
https://login.microsoftonline.com/{tenantId}/.well-known/openid-configuration

You can also see a more full example of the URI (for OAuth2) here :
https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-id-token-as-well-or-hybrid-flow
The example taken from that last link explains a bunch of extra params that are needed, as well as additional URI segments.

Hope this helps, Nick