You don't need to run the WPF client on the local SharePoint server, that would defeat the purpose. You also don't need WCF since SharePoint already exposes webservices. However, with 2010 the Client Object Model is available and is a very powerful and useful alternative to WebServices.
When using Windows authentication SharePoint will use the credentials of the application user. When using FBA you can specify credentials. See the Authentication section in Part1 below
SharePoint 2010 Client Object Model, Part 1[
^]
SharePoint 2010 Client Object Model, Part 2[
^]