Slava, I'm using just one Nios but changing the content of EPCS over ethernet is implemented there.
I will try answer your questions.
1. Yes it's possible. You have to know the start address of the firmware image. The best is when it starts at a sector boundary.
2. No idea
3. No you can use the alt_write_flash_block() or alt_write_flash() function from Altera HAL API. Data transmission is more save if you use an additional checksum.
Last Question: I think you have just one bootloader because only one EPCS device controller core can be instantiated in each FPGA design. The boot loader code is stored in a small onchip RAM in epcs controller.
Jens