You are in a good place with your 3ds as all the options are open to you. Your son must not get on the internet much to still beat 3.x, until recently that unit would have fetched a premium on eBay.
You need to get to 4.x fw and can go as high as 9.2, it doesn't make much difference in your situation as I am guessing any retail carts you have were never played on 6.x or higher firmware. For now I would suggest stopping at 4.x as you will not need and Internet connection to run the exploit. You can get there with a retail cart with 4.1-4.5 on it. 3ds.essh.co will list the firmware of the releases, I am sure you can find a used cart for a nominal charge to get you there, shovelware occasionally comes in handy.
How big the cards you get depends on ultimately how many games you want to have available. They range from small 128MB to 4GB so it is hard to put a number on it. You have undoubtedly run across the term .cia file that is installed to the internal SD card. These are like eshop games and have several advantages namely the icon is on the home screen and are smaller than a 3DS file that resides on the mSD inside the GW. If money is extemely tight you can get by with using the SD comes with the 3DS and just get a larger mSD for the GW. Personally I use 64GB cards in both slots, but 32 will be fine, the price savings on a 16 is negligible. I get Sandisk Utra or extreme. Or Samsung Evo from Amazon, just make sure it is class 10 or higher.
If online play is desired it is easier to use cia files for those games rather than messing with private headers for .3ds roms.
The blue card that comes with the GW will play DS Roms and is a basic flashcart, an r4i gold may be slightly better but not absolutely necessary. There is not a dual mode card.
Just follow the gateway manual posted on the downloads section of their site and read the stickies here and in the tutorials section and you will be fine.
Ask questions if you get confused and feel free to PM me anytime. Good luck.