to answer the questions in order
1 yes you will need a programmer if you look at this thread you will see which one I used and also some instructions Upgrading OpenEVSE / EmonEVSE Controller Firmware using ISP programmer - Integrations / OpenEVSE - OpenEnergyMonitor Community
2 You can do the update with the module connected, I did it with the power on just be careful as whilst you can power it from the program module it needs some config changes which I could not be bothered with.
3 Yes you need to do the firmware update before changing the ESP module as 4.x needs 7x and above
John