Connected Apps in general work in any org (e.g. see the Data Loader, SFDX, etc). However, JWT-based flows need a Connected App per org, as far as I can tell. See for example Authorize an Org Using the JWT-Based Flow.
As per my understanding, Once the authentication is completed, the session maintained at the browser level. Since you are already using the same machine to access Salesforce and nodejs app the session pickup from cookies and validated the IP address when you are using "lock the session to the originating IP address".
If the session id generates with in the ...
I did give a try and successfully able to get the access token. During this, I got bunch of things that I fixed as below:
App in Box should be admin authorized
Signing the request using JWS does not work for some reason. I need
to build the payload by myself without using jwt
Using Datetime.now for 'exp' does not work - may be because of gmt
conversion. So ...