What you mention as concepts and skills are - in your example - equivalent.

Authentication and Authorization are concepts, but so are databases and REST APIs. Designing a secure role-based auth system is a skill. Similarly, designing a REST API which confers with the JSON:API standard is a skill. You get the point.

With that said, I would highly recommend you to take a project and then apply these concepts (on the top of my head):

• Role-based or tier-based authentication and authorization;
• Data structures based on volatility vs. immutability;
• Server-Side and client-side caching;
• Message Queues and their more-applied form: delayed response mechanisms;
• Payment systems (this is a tough one)

I would learn how to develop an API, you can't say its just a skill, you need to learn all the bits around it, like making sure an endpoint is private, making sure it's secure, making sure it doesn't bottleneck your app and crash your server etc. With this you can also add authentication, be it via social etc. File uploading on an API? CRUD? etc

• Is interoperability needed or vendor lock-in OK? (PaaS, Vendor Pub/Sub vs Kafka, ...)
• Do microservices come in handy and what scalability will the platform have
• NoSQL vs SQL (scalability of the data)

Hard to tell. Decisions go case by case.

With "concepts", I think you mean "features". Features highly depend on what software you are building. For learning how to build these features, you should try to develop some sort of a pet project - say a Hashnode website clone. List down all the features you see and develop one for yourself.

Are you meaning "goals" instead "skills"?