CTR is insecure if you reuse a key/iv pair. Since the salt is random, a different encryption key will be derived every time you encrypt something. Therefore it is safe even if it always uses the zero IV. Of course, the password must be strong enough to resist brute force attacks.
I seem to recall that shared secret keys should be hashed before using as encryption keys (some brief discussion here).
If your key is already high-entropy, then hashing with SHA256 is fine. If you plan to generate several keys (ie, encryption and HMAC) from the original shared secret, then HKDF is a good option. This is a key-based KDF.
Scrypt and ...
Specifically, is it safe to re-use the same nonce for decryption an indefinite amount of times, if you only use it once for encryption?
Indeed, all good security definitions (under which ciphers are proven secure) will place no restrictions on the input of the decryption algorithm. The intution behind this is that the the input to the encryption algorithm ...
Your $k_2$ value is functioning effectively the same way as conventional password verification methods, where you store a salted password hash of the users' passwords. So it allows for an adversary to test password guesses, but—
So does the authenticated GCM $(c, tag)$ pair;
The memory hard scrypt function is your main line of defense against this attack ...
You can use a similar method like VeraCrypt. Also, you can use a better Key derivation alternative like Argon2id. Argon2id is the combined version of Argon2d, data-dependent, and Argon2i data-independent modes.
For the encryption
Get/force a good password from user and use it with Argonid with application/usage dependent domain separation
$$k = \...
The combination of different schemes may be somewhat advantageous with regard to certain custom hardware (ASICs), but I think that the disadvantages outweigh them.
I assume that there is some kind of fixed time that is acceptable to the user. Nobody will use a procedure where she or he has to wait several minutes.
Modern password hashing schemes are ...
scrypt is actually a password-based key derivation function (PBKDF *) created by Colin Percival; Stronger Key Derivation via Sequential Memory-Hard Functions. We want slower PBKDF functions since it will slow the attack times. The below is from hashcat performance;
scrpyt 1172.8 kH/s (16.61ms)