Site ID is at:
<yourdomain>/Utilities/API.aspx
or (from the admin tool) site settings + API Integration.
I didn't know about the minOccurs as I always went off the example pages and not the WSDL output, but I think you are correct it's not correct, I know that I have not been able to update orders without sending all the products (ordered) as well, according to the WSDL it is optional, but from my testing it is not.
I think you will have the best luck following the example page
CatalystCRMWebservice Web Service
Regarding the authentication see the above link as well, the examples have the authentication headers (with siteid) in them.