Few things:
The reason I ask these questions is because a few of my friends were victims of DDoS attacks and I'd rather not wake up in the morning with an extremely large bill due to going over my bandwidth limit.
Hey! I've addressed each of your questions below:
What counts towards it? Outbound, inbound, or both?
The bandwidth limit is based on a total of both incoming and outgoing traffic on your droplets' public interface. Traffic on the private network is not counted.
How can I view my total used bandwidth so I know how much I have left this month?
Total bandwidth use is not yet shown in the control panel. For this reason we are not yet applying bandwidth overage charges.
Is there a way to auto-shutdown my server if my bandwidth limit is reached?
There isn't yet. I'd recommend suggesting it here.
For the second question, I would recommend looking into a program called vnstat..
Although DO is not charging for it, but it helps to keep an eye on over all data to pin point if anything suspicious !! It helped me troubleshooting few issues with my server !!