Guidelines for Composer and deployment

So I'm a self-taught dev who has been learning through Laracasts and Udemy mostly. I likely have a lot of gaps in what best practices are, and may not know what to search for with regard to this, so apologies in advance.

I think I need some help with guidelines on using Composer across different environments.

What brought me to post this is that I've been having trouble setting up mpdf/mpdf for a particular app I'm working on for generating PDFs. The problem was that the package was so large that it would take too long and not download and install on my local machine unless I updated Composer to the latest version. Even then it was slow and it seemed like it only installed out of luck.

My test and production sites are on the same Forge server, which is probably stupid. I would like confirmation of this.

The problem is that I pulled updates to the dev site, but I didn't have the latest version of Composer. This lead to it timing out on composer-update, which I could stop. However, I left the problem unfixed and now the server is likely running composer-update as part of its restart process and I can't ssh into it as it times out... So I'm hoping support at Forge can help me out somehow.

So the things I would like some advise on:

1. Having both test and production on the same server is probably a terrible idea. I should probably spin up another server and split them apart.

2. Once I have everything working on a test server and update the master branch, how should I bring those changes to the production environment? In the case of getting mpdf/mpdf, via composer update, should I have just been more careful in following the exact steps to get it to work on test (remembering to update Composer itself)? Or should I transfer files in the vendor folder over? Or does Composer compile them in a special way?

Thanks for your time!