There are slightly less than 2²⁵⁶ possible private keys.
This will generate the same number of possible uncompressed public keys and the same number of possible compressed public keys.
However, it is incorrect to consider an uncompressed and a compressed public key with the same x coordinate as two different public keys. They are the exact same point on the curve. All that is changing is how we express that point.

There are 2¹⁶⁰ possible legacy addresses, and so on average 2⁹⁶ private keys per address.

Yes. For an address to match two private keys, all that is required is that there is a collision on either the SHA256 or the RIPEMD160. This could potentially appen with any combination of compressed and uncompressed public keys.