Welcome, and there’s no such thing as a bad question. There are a lot of developer APIs, tooling and such in the Shopify ecosystem and they’re tailored for different aspects of Shopify.
With Shopify, everything just seems to be publicly accessible automatically.
Not quite 100% true. Shopify apps are still running on your own infrastructure, the normal model you described.
However, there are parts of Shopify that you can deploy your code to using extensions. Extensions run on Shopify’s infrastructure, they’re published to a special extensions directory when you create them in your project.
The shopify.app.toml is just a configuration file. In the past, we had to update OAuth settings, like handshake URLs, access scopes, etc in the Partner dashboard UI only. Now with shopify.app.toml you can define these settings as code in your repo.
Hope this helps clears up some of the mental model of how Shopify apps work, but in general you should be creating a Github Repo for your app and deploying it to a host, just like normal.
The Extensions blur the line a bit, it’s your code, but it’s running on Shopify’s infrastructure, not your own.