A) I would have one player -- the channel's host -- do the pathfinding logic for both players. Players would say "I want to move to XYZ". The host would get this RFC and perform a pathfinding check on a separate thread. At the end of the check I'd fire an RFC back to everyone with the calculated path. All clients would then execute the movement using this path. Corrections to the path will also be done the same way -- host player detects a collision on the path and that causes it to recalculate the path and re-send the result to everyone.
B) Player side for sure. Hacked, yes -- but there are a bazillion ways to hack a game, and unless you're making World of Warcraft, you really should worry about making a great game first. If you are worried about hackers so early on in the game's lifetime, consider integrating an actual anti-cheat solution into your game. You're trying to fix a client side problem on the server side, instead of trying to fix it on the client side where it exists. We've had a few discussions about anti-cheating on this forum actually -- with some good suggestions all around.
C) React same way as single player. One player, generally one that owns (controls) the car will send the result of the collision to everyone else, saying "I collided at this position with this velocity, and this is the result" -- something to that extent. Although I don't bother even with that in Sightseer. I just let physics be completely local, and the corrections are sent out periodically by the players that control the cars on a regular interval. Input is sync'd frequently. Clients move cars based on input. Rigidbody pos/rot/velocity is sync'd every ~2 seconds or so, causing other clients to either snap or smoothly tween to the corrected values.