How do you set up SFTP?You would need to install an SSH server. The Windows typical way to transfer files for administrative use is RDP with reverse maps, network shares if you have a VPN to the server, the more general way might be IIS as an FTP-over-SSL or WebDAV server.
How do you set up a light-weight HTTP server?
Install Lighttpd. But you have IIS, unless you need a lighterweight server you may as well use it.
How do you set up Python + xCGI + Postgres?
Install Postgres and Python for Windows. (NB the free Microsoft database answer is SQL 2008 Express). I don't know xCGI but Python on IIS is possible via various WSGI/CGI/ISAPI interfaces.
Is there some sort of a package manager or a browser for paid server software?
No. There's Add/Remove Windows Componenets in 2003 and Add Features / Add Roles in 2008 for parts supplied with Windows, but nothing central for 3rd party software.
How do you secure it, e.g. what do you use for a server firewall
Windows Firewall, but that will only keep traffic away from closed ports and I am hesitant to trust IIS to the internet. We use dedicated firewall devices with deep packet inspection and AV scanning for all incoming traffic (we also do that for Linux servers).
permission isolation for web-facing software (sandboxing, maybe)?
No sandboxing like SELinux or chroot, but a pretty thorough and integrated permissions system that runs through the filesystem, ASP.Net/IIS, SQL server, registry, and more. Don't run web-facing software as administrative users, for instance.
Where is the configuration kept
Typically, the registry (start -> regedit). Sometimes editable directly, but not much fun. Frequently configuration of individual components is scriptable.
and the logs written?
IIS, FTP, SMTP logs go in c:\windows\system32\logfiles, other programs log to wherever you configure them or with general system logs into the Eventlog (proprietary format files). Use Event Viewer to get at them (terrible program in 2003, improved in 2008) or something like psloglist from SysInternals.
Where is the documentation for all of the above?
Everywhere. Start -> Help, or press F1 in most of the system management consoles for a lot of text. Lots more on http://www.microsoft.com and http://technet.microsoft.com
Or more generally -- how do I make it all work?
Why have you been given a Windows server that you know nothing about that appears to have no software on it? What is it and what's it for? If you want SFTP, Python, Postgres, lighttpd, you may as well format it and install Linux really.
Come back when you want an office of desktop computers with central logon, policies, centralised sharable email calendar and contacts, email available on the web and Windows Mobile, shared files and folders with granular permissions, software install and desktop lockdown policies, local file caches for offline laptops, running software that everyone in your office is familiar with and can read and write Office documents that everyone you contact can use. That's where Windows/Exchange(/Sharepoint/etc) strenghs show up, and if you're not doing that sort of thing then there's not much point using Windows Server.