Matt,
Short answer, yes to both. Details below.
The sdk allows you to do two things (this is not a complete list but the most common things you do)
1. Configure the backend
a. create custom objects
b. extend existing standard objects
c. create custom business logic ( scripts ) both for standard and custom objects. These are actions, messages, validations, and "exits" like creating/updating data that the user doesnt physically enter on the UI
d. access data from other c4c objects or API
e. create a custom data source on custom or standard objects
f. create a custom query on custom objects
g. create a custom approval workflow on custom objects
h. create a custom API on custom or standard objects
2. Configure the frontend
a. create custom UI on standard and custom objects
b. create dynamic UI on custom UIs
c. add buttons, fields, tabs, section groups on standard UIs
d. adjust properties of elements on standars UIs (read only, number of lines in a text box, visible)
I say configure as all SDK work is upgradable and supported as C4C is upgraded since SDK "code" is all metadata.
There are two IDEs (tools) you use
1. For backend, you use Visual Studio and there is a simple scripting language called ABSL to write your custom business logic and custom objects and extensions to standard objects. As well as, some point and click wizards to comfigure a query, API, datasource, and approval workflow.
2. For front end, you use UI designer. This tool is all point and click and there is no code, but a bunch of drag and drop and point and click configuration to create or extend a UI.
You install the Cloud Applicatoon Studio (SDK) and it will install a free version of visual studio, the c4c add-on for visual studio, and UI designer.
Yes, it is possible to create a custom UI or a custom UI element on a standard UI which could render data from an API call. This is all done through SDK.
Yes, it is possible to deploy an iframe (in C4C they are called mashups, in onprem they are known as ITS transactions). Iframe can be displayed on standard and custom UIs. Configuration for this is done in the mashup configuration UI which is in the adminisrator work center. However, as a prerequisite the UI has to have "outports" if you want the UI to push c4c data elements as URL parameters and sometimes "inports" if you want the mashup to write back/push in a c4c UI element. Not all UI elements are available in standard UIs as inports and outports, so you may need to create a custom embedded component with the in ports and outports you need to meet your requirements and deploy it on the standard UI. For example, if you want a google map widget on the visit thing inspector as a tab using the checkin and checkout gps coordinates captured in the visit UI, you can push this gps data out as an outport as URL parameters in a Google map URL to render pins on the map. You could then create a button in google maps that on click of the map write back the gps coordinates at that point in time into a custom field c4c field the visit to track who and where this data was accessed for compliance auditing.