Only sender and receiver (the “ends”) can decrypt the data, ie have the keys. In this case both ends are “you”, and the passphrase is the authentication for new devices. For e2ee to hold, neither the passphrase nor the key can be shared with another party, for instance Mozilla.
> 1. If you lose your password and didn't setup a separate password recovery code (one time codes), then you're toast.
That sounds right, and is similar to password managers. Your data is encrypted as a vault with a key derived from the passphrase. The vault is opaque to anyone without the key. Though you still have to trust the software.
[I edited my comment above to get into more nuance about password reset is possible, but wipes data.]
If you lose your Mozilla account password, you can reset it, but
> Any data you have on the server will be erased when you reset your password (unless you use recovery keys). Your other devices will stop synchronizing unless you update them with the new password.[0]
[0] https://support.mozilla.org/en-US/kb/ive-lost-my-firefox-syn...
In general though, the info is stored on Mozilla's (or an affiliate's) cloud.[0]
1. If you lose your password and didn't setup a separate password recovery code (one time codes), then your data is toast. You can't reset your password via email without wiping your cloud data because mozilla uses your password in a hashing algorithm to store your data.
2. If I recall, you have to setup a 2FA to login on new devices.
[0] https://www.mozilla.org/en-US/firefox/features/sync/
*EDIT: revised above to clarify mozilla password reset wipes data unless you have recovery key.