A login is the principal that is used to connect to the server. A user is the principal that is used to connect to a database. The security context on the instance itself is dictated by the login, it's roles and the permissions granted/denied. The security context on the database is dictated by the user, it's roles and the permissions granted/denied.
Like all other role based systems, the roles are logical groupings of permissions. Roles can be applied to users and logins. There are fixed server roles and fixed database roles for frequently used sets of permissions.
A schema is a database object that is used for two things: logical separation of database objects (tables, stored procs, functions, views), and security separation. A schema contains these objects. And users can be granted/denied rights on schemas, implicitly granting/denying rights on the objects contained within.
4 doesn't really seem like a question. Can you reword??