First, we should look at what the name "Trojan" actually means:
In a 10 years long war between the Greeks and the city of Troy, the Greeks built a wooden horse and offered it as a gift to the city (or simply left the horse outside of the city while pretending to sail away - stories differ sometimes).
The inhabitants of the city pulled the horse inside, where nothing happened until the night. The horse actually contained soldiers, that slipped out, opened the gate to the returned sailors and murdered everyone inside the city of Troy, thus winning the decade long siege.
Therefore the metaphor for a "trojan horse" when it comes to computer security means "something that looks innocent, you put it into your computer where it stays dormant for some time until it activates something bad for its host".
Today, most trojans dont look like horses anymore, but can take totally different forms.
1) No, they dont need to be .exe-files only. They can be .bat (batchfiles) as well, MP3s and several different other formats. Especially on Windows-Systems the user can de-activate the extension to show up, so a attacker can name its trojan
"InnocentWordFile.docx .bat". The user will usually only see the first part and not the .bat-part.
The "shell" does not matter, the important part is "something, that has something else hidden inside".
2) I am unaware of a MP3-trojan. There might be vulnerabilities in certain players, but there is a better way of creating a MP3-trojan. Simply look at point 1):
"MyHottestMixtape.mp3 .exe". When the user clicks this file, the trojan starts a player (either its own or a system player), plays the music while it does something else in the background.
3) Yes, because that is the definition of a trojan: It looks innocent from the outside, but contains something malicious on the inside. So code / software you load from a untrusty site might contain trojans.
4) I bet there are forms for a trojan that I am not having in my mind at the moment. In general you should install software from a trusted source (dont download .apk-files from "somewhere" for your Android-phone but from the Google-Play-Store) and have a virus-scanner handy.
You also can use virtual machines / sandboxes in order to test new software without infecting your machine.
But be aware, the time that a trojan takes to do something noticably can be large!