1. How do I “load WP” in the root folder? Do I do a fresh install and copy over certain files from my current site? (and then run the queries on the database?) Or do I copy and paste every folder and file from my current site, and this somehow ‘installs’ WP and duplicates my site (and then run the queries on the database?)
It sounds like your main site already exists. Easiest will be to copy all the files in the entire WordPress installation. Load a copy of them in the root folder of the subdomain (or folder, if you decide to use a folder instead of a subdomain).
Then you have to create a copy of the existing database and run a few queries on it, to replace all references to the live site URL to the test site URL.
Here is an article that summarizes the steps (it leaves out the need to run the queries on the new database)
https://www.prelovac.com/vladimir/how-to-move-wordpress-site-to-another-server-with-zero-downtime
Here is an article on how to back up the database
https://codex.www.ads-software.com/Backing_Up_Your_Database
Here are the 3 queries that get run on the new database after it’s been created. Change “old-url” to the exact URL of the domain as configured in your live site – see Admin / Settings / General for the details. Change “new-url” to the new domain url. If you don’t know how to work with PHPmyAdmin, the “how to back up your database” article link shows how to get into PHPmyAdmin. You then click on the SQL tab on the horizontal options at the top, and run these queries one at a time by pasting them into the query box. This must be done, to keep permalinks and image URL’s working correctly on the test site.
UPDATE wp_options SET option_value = replace(option_value, 'https://www.old-url.com', 'https://www.new-url.com') WHERE option_name = 'home' OR option_name = 'siteurl';
UPDATE wp_posts SET guid = replace(guid, 'https://www.old-url.com','https://www.new-url.com');
UPDATE wp_posts SET post_content = replace(post_content, 'https://www.old-url.com', 'https://www.new-url.com');
2. Do I use the .htaccess method to password protect the subdomain?
yes, you can do that. If your server uses cPanel there is a cPanel option to password protect a folder. You can use that if its more convenient.