Question # 1 ... Is this the only time a password is needed?
The user needs to get their public key from Q to A. There are a variety of means to do that (system administrator could set it up for them, they could log in with a password and install it themselves, some form of automation could add it). Regardless, it would be the policy of A to determine if a password could be used or not. So, in the example, you would not need the password for A again, but, if password logins are allowed your password would still be at risk.
Question # 2 ... If a hacker acquired the private key could they log in from another server?
Yes they could. Assuming they also knew the userid the key was associated with. Just the private key alone would not allow them access. It would have to be paired with the user.
Considering your question, there are a variety of means to secure A from an attack like limiting networks that it would accept a login from. This is too complicated a discussion for an answer here but you could limit your risk.
Your assumption that a key without a passphrase it is no more secure than a password is very broad. Like any security mechanism proper controls over the security assets is critical. In many cases keys are extremely useful and when coupled with secondary mechanisms like access control, network limitation, etc. they can be very effective.