Backlinks. Anchor text. Find people that will link to you using the words you want to rank for.

"Their site has no purposeful SEO in it, there is barely any text on the homepage at all and none of the text are the keywords it is ranking for."

The above statement is concerning. If they have a good budget, as their SEO and design advisor I would say what needs to be said. Text can be added in a stylized way to help improve the SEO of any site without taking away from a good design. Google likes words, not CSS and images. Without a reference, it's hard to judge what can be improved, and how you should go about suggesting it to your client. You also mentioned rankings, but what do those rankings look like? Are we talking page one, or top 3?

Take a look at the image index rate, and see how many are indexed and showing. 20k images is quite a bit, and I would want to see if Google actually indexed them all before I started creating redirects for that many items.

If they are indexed, see if there is a way on your new site's sytem to have the images named the same. That way you would only be creating a redirect for the image paths, and not the images themselves. Example:

oldsite.com/image/25/coolpicture.jpg
newsite.com/images/awesome/25/coolpicture.jpg

All that would be needed would be an HTACCESS rule redirecting from one directory to the other, using the image name as a variable. You could probably redirect most of them using only a few rules than 20,000 separate redirects.

Is it worth it to redirect? I think that depends on how many are indexed, and if the images bring you a significant amount of traffic.

"Should the 301 redirects map the canonical URL on the old site to the corresponding canonical for the new design . . . or should they map the non canonical database URLs old and new?"

Any URL's that are indexed should be redirected to the correct version. For example if you have both a database URL and a canonical URL both indexed in search results, then they both should be sent to the correct version.

Also, having only canonical URLs in your submitted sitemaps will help to remove a lot of these, even without redirects.

If all the pages are not indexed, then yes I would assume a penalty. One of the more common reseaons a site gets penalized is due to improper linking, either inbound or outbound in nature.

If you do not yet have access to webmaster tools, there are still steps you can take. This is something you are going to have to do anyway, once you figure out what the penalty was for.

First place to start: links.
There are a wide variety of backlink tools out there. Here are a few you can try:
http://raventools.com/marketing-tools/link-manager/
http://moz.com/researchtools/ose
https://ahrefs.com/

Start looking for the spammy or paid links. How can you tell? Simple. If a link has a domain like rankmehighingoogle.com or something like that, chances are it's a bad or paid backlink. The example given is a silly domain name, but you will see some like that come up. If you are unsure of a links quality, manually visit the sites to see what they are all about. If the home page has a 0 or a ? for pagerank, chances are the linking site got hit with a penalty and you should disavow that linking domain.

Another way to test is to search for the linking domain in Google. If you search for a web directory site or linking domain specifially by their name and they are nowhere to be found, Google most likely hammered them for some practice they were using.

Since you dont have access to GWT yet, this would be a good way to see what is going on with this site. You stated that you just started doing the optimization for the client, so you most likely havent had time to research the domains history yet. Once you have access to GWT you will be taking a look at links anyway, so while you are waiting for access be proactive

Always link by page and subject matter. If you have an article about red widgets, you should link back to the page you have about red widgets. True you can build up your home page with a lot of links, but this hurts your user experience by making them have to go through the entire site to find what they came there for.

When you send all your links to the homepage, you are suggesting what page is the most important to search engines. This can often be seen where you have sites that never have any subpages ranking or showing up in search results, only the home page over and over. Sounds great doesnt it? But you can limit the exposure of your site in the long run. By directing links at your subpages, not only do you increase the chance that they will eventually rank higher, you also can get more specific with your linking text.

Direct keyword linking to the home page is more risky. With your subpage links, you can get closer or even use exact keyword phrase links because the content is more specific. In reality, use whatever link phrase that a user will click on. A bunch of keywords might not do that job as well as a conversion statement. If you are worried about getting people to your home page, change the way the subpages are set up on your site, so that users can go to the other relevant areas of your site with ease. It should be easy and simple to direct them where you want them to go using graphics or styled text.

It seems like you are actually asking 2 questions in one. Let's approach them both separately.

Should you include index.html or not in your structure? Personally, I think the cleanest URL structure works the best. Get rid of any URL parameters that do not offer any benefit. Cleaner URLs not only look better, but are easier to read and share. Who really wants to share DOMAIN.com/fishing.index.html vs DOMAIN.com/fishing. It may seem petty, but in the grander scheme of things it will just work better. If you do this in one area of your site, keep it consistant through the whole site

As to making sure that Google only indexes one version, this can be done through the URL parameter redirects on your server. You can create rules where the URL automatically strips out any additional URL items, and redirects to the proper version. Once you create your sitemap, make sure to only include the versions of your URL you want indexed. One thing I have found in my entire SEO career is this: The easier and clearer you paint a picture for Google about your site, the better your results will be.