Link login?

Yes, what you want is entirely possible - you can either have the Macs authenticate against AD, or setup a Golden Triangle where the XServe slaves off the AD directory rather than runs its own.

You may have migration issues, though - this is something that's easier to setup from scratch than it is to try and migrate users from one directory system to another, especially since the username already exists in AD. If you can deal with the one-time pain of moving each user's data then a Golden Triangle would be the way to go.

It's not a trivial, one-click process, though. It's covered in some depth in the Server Administration Manuals.

No, leave the clients bound to AD (you might also want to join them to OD, but it'd be for policy & preference management, not authentication). The preferred way to get single-sign-on authentication is with Kerberos; both Macs and Windows use it when they're joined to a domain, but I don't think it can be used for either 802.1X (wireless auth) or Time Machine backup.

There is, however, a way to get much the same effect for 802.1X: switch from a user authentication profile (what your users probably have now) to a login window profile. Then the login window will use the same name & password for both logging into the computer and authenticating to the network. The relevant setting is in Network preferences -> Airport (or whatever the relevant service is) -> Advanced button -> 802.1X tab -> use the "+" button at the bottom to add a Login Window Profile. I haven't used this, so I don't know precisely what settings you'll need, but in principle it should solve the problem.

Time Machine is a more difficult problem. The issue here is that it runs independently of who happens to be logged in (if anyone), and hence cannot piggyback off the active user's authentication info. Unfortunately, I don't know a way around this one.