****NOTE: Before doing any AD development, be sure your client isn’t going to change their AD structure and that you have an accurate reproduction of their structure in your dev environment.****

I’ll give more detail later, but these posts helped me:

A couple of things on site group creation. Though, I did learn that I can add an AD group to a sitge using the same code as adding an AD user to a site.

http://sharepointxperience.blogspot.com/2007/09/add-new-spgroup-programmatically-to.html

http://www.sharepoint-answers.com/microsoft/SharePoint-Development/29624950/anonymous-access-and-sharepoint-objects.aspx

Checking the current user’s permission on a web site or a list by code
http://www.sharepoint-tips.com/2008/04/checking-current-users-permission-on.html

I never actually got this to work according to the way this post says it should, but it explains a lot about that “Limited Access” role that helped me:

http://hristopavlov.wordpress.com/2008/07/10/be-careful-when-manipulatin…

(My problem, btw, was that I was hitting the wrong site when I tried to add permissions–I was grabbing the root site instead of the subsite I wanted to add permissions to.)

This one was a HUGE help–I needed to add permissions to a page that had to be checked out, but I was just creating the page for the first time and setting permissions. Added bonus: if you’re logged in as admin, you just need to change you .Update to .SystemUpdate–no need to worry about the “RunWithElevatedPrivileges”:

http://gabewishnie.blogspot.com/2007/03/update-splistitem-without-having…

Finally, setting anonymous access:

http://stsadm.blogspot.com/2008/03/set-anonymous-access.html

Thanks to all those sites for helping me through a looooong day!