As a rule of thumb you can say that every URL that ends up in the browser address bar anywhere should be a public URL, therefore a separate zone has to be created. As a good practice, each zone should have its own separate IIS website so you can configure different IIS-related settings like host headers, SSL certificates etc. The public URL is what's being used by SharePoint to render your content correctly and to assure a consistent URL experience.
The public URL is not necessarily the same URL that is used in the request that the server receives, but SharePoint will always answer with the public URL in its response. This is useful in scenarios like publishing a web application to the internet. Users on the internet might make a request to
https://www.internetsite.com, but the reverse proxy server may forward this request to
http://servername:1234. In that case you have an internal URL
http://servername:1234 that maps to a public URL
https://www.internetsite.com. This allows the SSL certificate to exist only on the reverse proxy server which simplifies management. This is just one use case for AAM's, there are other like the redirections you mentioned.
The IIS host header on the other hand is used to make sure requests arrive at the correct IIS site in the first place, before getting picked up by SharePoint. In my example we could have an IIS web site without a host header as we're just using a port number. If we would redirect our reverse proxy server to
http://internetsite.local however, we could set a host header of internetsite.local on the IIS website. This way IIS knows which website on port 80 to send the request to.
So the host header in IIS is not neccesarily the same as the public URL in SharePoint, but it will always exist as an internal URL in the AAM mappings.
The different zones in SharePoint relate to having different public URL's and different IIS websites. This allows to have different settings, like different authentication mechanisms as you describe. In SharePoint 2010 you can have multiple authentication providers in one single zone however. The names used for the zones are just labels, you can use any zone for any purpose you want. Only the default zone is a bit more than just a label when it comes to security.
A very good and thorough series is the "What every SharePoint administrator needs to know about Alternate Access Mappings"