Out of the box, the form definitions and form data are stored into the embedded eXist database. The source code you can see directly from Form Builder, with "Edit Source".
No.
Regarding the question in your update: you can disable the orbeon-exist-filter
eXist security filter in web.xml
, then should be able to connect with oXygen either via exist-xmlrpc-servlet
or exist-rest-servlet
which is mounted on /exist/rest/*
.