What is the lowest available to the cartridge CPU address, i.e. how much down to zero the cartridge space may span, whether it would be PRG-ROM, PRG-RAM or cartridge registers?
Well, everything up to 4020 is filled, or better internal chip select decoding will fire for each and every address. For example the 2 KiB internal RAM are visible 4 times on $0000, $0800, $1000 and $1800. Similar the 8 PPU registers are mirrored a 1024 times.
The secret here is that RAM and PPU is selected via a 74139 TTL, while the APU is fully decoded within the CPU/APU chip. The 74139 only decodes 3 large areas ($0000-1FFF, $2000-$3FFF and $8000-$FFFF) to select RAM, PPU and cardridge. No provision is needed for the APU as this is already done on chip.
The $6000 border seems to be just a conveniently-decoded one, it is possible to have for example PRG-RAM from $4100 or so (provided that $4000..$4020 range is occupied with sound and OAMDMA on-chip registers)?
Yeah, that's the fun part, unlike all other internal hardware, the APU is decoded down to A5, thus realy only reacting to $4000..$401F. Therefore everything from $4020 up to $7FFFcan be used with the 'PRG-RAM' trick for a total of 32KiB-32B.
Well, with one exception: The Famicom Disk System. Its hardware registers are located after $4020. AFAIR less than $20 Registers are used, but the address decoding is only down to a whole pave, so all all addresses $4020-40FF are taken.
So why is there no cardridge using the Space between $4020 and $5FFF ?
Well, adding 8 KiB at $6000 is a simple RAM Chip (6264) and one 7400 TTL. Adding another 8 KiB (minus 32 B), would not only require another 6264, as there are no 16 KiB RAMS (or at least wheren't back then) and at least two TTL for decoding. Not to mention the space needed to crap that into a cardridge. Money better spend for more ROM to enhance the game.