I did some research on my own questions there and came up with...

"protected" is good (for regular consumers anyways); the battery includes a circuit with high cutoff (to prevent overcharging?) and low cutoff (to prevent over-discharging?), both of which can be dangerous. (chemical fires, explosions). Mine say 4.5/2.75, so they are allegedly protected.

mAh is milliAmpere-hours. The important thing there is hours; so if you were to draw 1 milliAmp from a fully-charged battery, how many hours until it runs out? 2 milliAmps would be half the time, etc. So basically it measures the capacity of the battery; how much "juice" it can hold (and discharge). Bigger mAh = longer runtime. Mine say 2400, but are possibly actually under 1000.

I found this interesting article at CPF (candlepower forums). Who knew people geek out over batteries as much as we here at BF geek out over bikes?! Anyways, it seems likely that

* my batteries are not truly UltraFire brand, but are
* recycled, re-labeled
* unknown mAh
* unknown "protected" or not
* I should never buy 18650 batteries from eBay.
* This from an american online company looks like it might actually be what my batteries claim to be (UltraFire 2400mAh protected), at $8/ea
* This Tenergy 2600 mAh protected (one of the reputable brands cited above) looks like an even better deal at $7/ea.

Strangely, batteryjunction.com doesn't have any 18650 over 3000 mAh (then again they don't appear to sell any Panasonic either). If somebody else has online sources for 18650 that they recommend as trustworthy, that'd be good to know too.