-
I believe C2 is on the wrong side of diode D1.
-
STM32 GPIO are 5v tolerant as INPUTS. They do not, however, output 5v. Pulling up GPIO lines (with the exception of I2C lines) to 5v will cause a current flow INTO the pin when set to HIGH since only 3.3v is output on the pin. I2C lines are run in open-drain mode, only pulling the output to GND so there is no conflict.
The Application Watchdog, implemented as a FreeRTOS mechanism, will not work if the processor locks up and thus the need for an external watchdog. There are watchdogs with longer refresh periods which may be more suitable (than 20ms),