I will give my opinion on whatever I know or tested!

The basic step should be going linux or bsd! Otherwise anything else makes little difference since they would fingerprint and cross reference you either way with 0 effort!

Firefox is ok but since google stopped paying them 95% of their revenue (bribe money for setting google as the default search engine) and now they need to make money themselves and they withdrew from "no tracking and privacy" promise, you can find they changed it soon after the court decision on google monopoly, available on internet archive - it is time to fork or harden! Arkenfox or whatevet that config is called...

Librewolf is cool, I have a menu to pick my profile each time I start it up so I can have my eromanga separately, and it has anti fingerprinting stuff by default by spoofing technical info I think like screen resolution, so they can't go from anything but already existing cookies or same IP across sessions. I am not too sure though.

I don't like brave. If they close down Chromium like they recently decided to do to some aspects of Android then it is dead unlike base Firefox.

Not much opinion on search engines. I use teh Duck. If they have an onion domain then they must be at least ok. Heard of SwissCows and Qwant but never tested.

Not much opinion on password managers. I am used to keepassxc for my darknet credentials (available in pacman) and notes. On the clearnet I have everything within my Librewolf. Since all devices are encrypted then I fear nothing keeping it handy in there. You can also run a server for synchronising your Firefox account offline by which I mean you can run your own sync server for passwords and since Librewolf is a fork then it will work with it too. It is a bit better than rsync since it would give separate devices identities instead of pretending to be the same device I think.

For VPNs I would make my own by planting a little machine at my relatives house on the other side of earth ideally and telling them what it is and that I would contribute to electricity bill. Second would be planting a RAT to someone in some Gabon type of country or growing a botnet in general. Third would be renting a service like from Mullvad but since they are registered in Sweden then I would not expect privacy too much. I paid for a 2 year code of Surfshark but I don't use it for anything besides basic identity masking. Surfshark actually offers OpenVPN credentials too and you can add them easily with no proprietary apps to your connection methods.

And any email is bad as long as they discriminate you for using TOR while registering
I use cock.li as my anonymous mail. Secondarily Proton but they work with police, so that is very bad. Do they let you register with TOR?