My IP is: 69.146.88.14.

Yes, but it does not solve the problem. Once people knows the brain-wallet password, he can withdraw the money on any computer. It does not matter whether you create the address online or offline.  Creating an address offline only avoid sniffering, but cannot avoid dictionary attacks at all.

Ha, very nice!  I agree with you, both have weak points.  People can stress about a wallet file on their desktop that could be stolen, destroyed with the computer, etc..  I think there are ways to improve security with Nxt model, such as limiting unlock attempts per minute for a specific IP, or perhaps locking a specific Nxt address to an IP as an option for the user, so you could only login from a specific IP address, etc..  There is room for improvement and the good thing about Nxt is you won't get the online hosted wallet thefts like BTC is seeing.

It's dangerous to test your phrase online. People could record them and add to their dictionary. Currently the only valid way is to restrict the minimum length. Even the entropy is low, unless you are using a sentence from books, a pass phrase of 30 characters should be pretty safe for normal accounts.

Why the hell would I go through hurdles of creating offline account for cold storage and then use password "12345"

Of course high entropy pass phrase should always be used regardless of cold/hot storage. Use 8+ (make that 10+) diceware words or random generated 30+ symbols.

Does my client need to be running to "mint" new NXT coins?

I see what you mean but even a random single or double digit being issued would be easy to remember and work round the security floor. Or username/pw like on blockchain.info.

If you look at blockchain info even with that security measure in place they've changed things (obviously out of a need as they've got bigger) so email & pw is no longer acceptable.

It depends on what you call "client".

That original funny web interface makes things a bit complex in terms if "client", "server", "peer", "account".

I prefer to name original software (Jetty + Nxt servlet, that you see as terrible black window) as "server". So we have p2p network of servers.
Browser, connected to one of servers, acts like lightweight "client". Client is dumb, it only show data from server, accept clicks on buttons and so on, but it doesn't perform any actual work for Nxt net.
Actually, there can be different client software even for original server, because server provides some API. And it can be not only browser. But for now there's only one original client.
"Account" is just a piece of data inside server's memory. When you unlock account, server software just create some bytes in memory and start to process it.

So, answer is: you need to unlock your account on some server (better you own server), than you can close your browser - server doesn't need it to perform work for net, and for mining too. If you restart server, you need to unlock account again.

So I followed all the instructions but nothing happened... what do I do at this point?