APM httpagent401 in clientless mode?

Are the irules in general run before the apm module or what controls in what order it is run/evalueted?

Roughly speaking, all layer 4 through 6 events (TCP, SSL, etc.), and the HTTP_REQUEST (and optionally the HTTP_REQUEST_DATA) events get triggered before any of the ACCESS events. Then the HTTP_REQUEST_RELEASE and HTTP_REQUEST_SEND events, and all of the server side events are triggered after the ACCESS events. There are actually non ACCESS events that get triggered during an ACCESS policy evaluation, but they are hidden by default.

are the session username and passwords stored in the ordinary session.* variables when the authentication is forced this way?

Yes.