You are largely on the right path. Get your HDDs second hand and you will save a lot, and you probably don’t need a separate hub for the server as they could just go straight into the motherboard. Check its model to make sure it supports at least 4 sata ports for expandability (ideally 6+ but harder to find). Use the HDDs in a raid configuration which protects data if one fails.
A UPS is probably overkill unless you live somewhere with regular power outages, and even then you might not really need one… Could be something you get down the line rather than immediately if cost is a concern.
For CPU I recently built my home server with an Intel i5 12500T that I got used with a warranty. The iGPU on it is actually great and handles transcoding for jellyfin exceptionally well. I run it all through docker on debian and drivers are all fine for it too (there is a bit of setup for GPU support with the docker image but not much). Personally I would not bother with portainer and use docker+docker compose directly. It’s fairly simple to set up an ssh connection from your pc to the server over your local network for admin work. If you go down a path which has you using gluetun then I highly recommend you do not use portainer to manage that setup.
I do some machine learning on my music library with just 32GB ram and the cpu. It’s running 24/7 and not urgent so I never bothered with a GPU. ML runs just fine on a CPU, but a bit slow. You may find you don’t need a gpu for image analysis workloads.
Generally you want to keep power consumption low. I run around 20 docker containers giving me a full backup system, home media system, gaming servers for friends, and a few other things which totals around 1.5Kw per day. Where I live this works out at at around an hour of minimum wage per month to run. I suspect if I went with a laptop oriented CPU I may have made some more savings here.
For off site backups I would personally just store historical data on an encrypted external SSD then leave it with a friend. Gets a bit trickier to do it in real time but if you go that route then use tailscale as other have suggested. Do not port forward anything to your server or your friend’s house as it’s a unnecessary risk which you can skip with tailscale.
I also have that fear but I have yet to have a hard drive fail on me in over a decade. If you are not doing heavy write usage then they are unlikely to fail. In my main PC I have a HDD I use to store game files which is now in its 14th year of usage. I would personally not trust it with sensitive data but it hasn’t failed on me yet.
Having a good raid setup also means you can have failure without losing anything. You also will have an off site backup on top of that. If cost is a concern it is something to consider as it can be a lot cheaper. I have at rest encryption and a warranty on the used drives, so if they fail soon after I get them setup I just return them for another.
Depending on consumer laws around used returns where you live you could use the ‘SMART’ tooling on the drives (it’s a built in self reporting on health/usage duration etc) to discover if the drive is still good to use and return it if not.