I think you've skipped a bunch of troubleshooting steps into the realm of paranoia.

You need to take a step back, take some deep breaths. As another commenter said, ensure that you are taking care of your own health, because you're not wrong, this sounds batshit.

After that, you can start troubleshooting one thing at a time, starting with the most basic, ignoring any assumptions and focusing on only what you know as fact. Your description is so flooded with extraneous detail that it's hard to follow, but what I got out of it is this:

• You're incredibly concerned about privacy, but not particularly knowledgeable (using TOR for all web browsing, using random VPN without actually looking into it, instead of taking some time to study before you jump in feet first).
• This means you are likely to be using some combinations of software and settings that are non-standard, that you may not fully understand. I don't mean this as an insult, we've all been there, but we need to stop focusing on what you assume. The type of people asking for help on asklemmy of all places are not the same people being targeted by state actors or "super hackers", unless there's a lot of shit you left out.
• This is on top of your admittance of doing vibe-coding with all the supply chain risks that you are thankfully somewhat aware of.
• You recently changed VPN providers. This is not placed at any point in the overall timeline, so we cannot begin to guess at any relation to further events, such as shady VPN software installs before or after certain listed issues.
• You recently torrented some FLAC files and used VLC to play them, which is the last thing you recall doing before you started having your most recent issues, which appear to be your router requiring a firmware reflash, and the keyboard input issues.
• "Around that time" of the FLAC album download, but not specifically before or after, your router stopped working and required a full firmware reflash. You do not say where you obtained this firmware, if it is the official manufacturer firmware or something custom/third party like OpenWRT. This was a few days ago.
• After fixing the router and cleaning, you begin having keyboard input issues. No word on of the cleaning involved any spraying or wiping of the keyboard before you noticed issues, so no idea on hardware damage or accidentally triggered keyboard shortcuts.
• Keyboard issues noted: One row non functional, some keys entering multiple times on single press, issues with capslock/shift
• You moved the HDD to another machine, played the FLAC(s) again, and the keyboard issue started again.

I'll be real, your immediate jump to thinking this is some sort of targeted active attack is silly. You need to isolate if the problem is with the keyboard, settings on the installed OS (specific to the drive), or after you play the FLAC file. Test one thing at a time, offline. Don't introduce additional variables. You'll also want to ensure VLC is fully updated, as a number of updates to it are security related. Embedding malware in media files isn't common, but it's much more likely than being the target of an intentional attack, or of picking up malware capable of jumping across multiple firmwares.