For example, I want to know if clients can read and write to servers, or read only.
Depends on the server. One of the attributes on a Node is its AccessLevel. Generally read/write, though...
Are servers broadcasting their own existence, or their data, or do clients broadcast requests foravailable OPC servers.
They might... they might not. There might be a discovery server in the picture, there might not. The most straightforward situation is that each OPC UA server has an endpoint URL that clients use to connect directly to it. Less common is that servers are configured to register themselves with a discovery server, which clients query for a list of servers.
What defines the OPC-UA client/server/PLC relationship (generally speaking again. For example, are the PLCs usually just volunteering information onto the network, or do OPC-UA servers query that information and then rehost it, or can clients also query the PLC)?
Classically, OPC servers query the PLCs for data using the native protocol for that vendor and model. Newer PLCs are starting to have OPC UA built in so an OPC UA client can connect directly to the PLC without going through an intermediary server (like Ignition's built-in server, or Kepware).
Do any PLCs act as OPC-UA servers?
Some newer ones, see above.
Can I expect to just write an OPC-UA Client/Server and start reading data from PLCs, or do I really need to make specialized drivers for each type of PLC?
If you're going to be writing the server, then you also need to write specialized drivers.
If I need to write specialized drivers, is there documentation out there on the protocols expected by Rockwell PLCs for tag queries by OPC clients/servers?
Sometimes. Depends on the vendor, model, and protocol. Rockwell has decent enough documentation on accessing Logix tags, for example. On the other hand, Siemens has zero documentation and everything anybody knows about it is reverse engineered.