Do I need to fill in og:title and og:description separately from the page's title and description?
No, unless you want different text on the social card. If you leave the og:title and og:description fields blank, the generator automatically inherits the page's title and description; only use dedicated fields when the card's text needs to diverge from the search text.
Does switching og:type from website to article change anything visible on the card?
On most platforms, little to nothing in the card layout itself: og:type is mostly an internal categorization the network may use to decide how to index or group the link, not a field that redraws the preview. The visual effect, when there is one, is secondary to og:image, og:title and og:description.
Why does the http image still show up in the generated block, even with a warning?
Because this generator's warnings are advisory, not blocking: it never refuses to build a tag over a risk, it only flags the risk for you to decide. The insecure og:image goes into the HTML exactly as typed; switching to https is your call, not an automatic fix.