+3 dice means 3 more than normal. So if you are normally entitled to 1, you will roll 4. Most rolls give you 1 die by default, but there are some exceptions (in particular, praying uses 2 dice by default).
Tactics are the only powers that generally replace
your normal dice (they'll say something like "fight with 2 dice" instead of "+1 dice in fights").
Yes, the Priest can use Sanctuary with 0 secrecy. Darkest Night makes a distinction between spending
a resource (which you can only do if you have enough) and losing
a resource (in which case if you're already at zero, you just ignore it). See the last paragraph on page 4 of the rulebook.
Ambush requires that you spend a secrecy. If you are attacking a blight, you will also lose 1 secrecy for attacking, as normal (note that this is a loss, not an expenditure, so you can ignore it if you are at zero after spending 1 for Ambush). But you can also use Ambush during events or when defending, if you want--for example, if you end your turn at the location of a Lich blight, you might decide it's worth spending a secrecy on Ambush to minimize your chances of taking a wound. In that case, you're not performing an attack action
, so the only secrecy you're out is the 1 you spend on Ambush.
Sap can be used at any time during your turn and does not require that you perform any specific action. For example, you could exhaust Sap to weaken a blight (for someone else to attack), then immediately perform a hide action to refresh Sap, or travel to another location.