Here's Evan's "plain vanilla" answer:
- Promote the server computer to being a domain controller.
- Join all the PCs to the domain.
- Convert all the users' local profiles to roaming user profiles and implement folder redirection
- Setup some kind of VPN (either using the W2K3 server as a VPN server or using a dedicated hardware appliance-- your call)
- Configure client computers to allow incoming Remote Desktop sessions and use them as "dumb terminals"
- Run backups of user data on the server computer-- daily, weekly, etc. Test your backups. Make sure they really are backups (see http://www.taobackup.com/).
- Have sufficient fault-tolerance in the server hardware to handle hard disk drive failure, at minimum (i.e. RAID). Handling power supply failure is nice, too, but more expensive. Having a UPS on the server computer is "a must".
I'm glossing over a lot of that. It's probably only a few days work, when all is said and done. There are a lot of questions I'm not asking here, but it's a good skeleton of a plan. W/ 15 clients I'd be shocked if it took more than 30 hours to whip that into shape. It could all be done once PC at a time, too, to prevent your users from all experiencing downtime at once. If you pay attention to detail it can be done reasonably seamlessly for the users (by migrating their user profiles) such that they hardly notice it happened.
You should be storing data centrally and running backups centrally. You can't have any information security (confidentiality, integrity, or availability) without that. Storing files on PCs make them ticking time bombs.
Roaming user profiles, group policy, and centralized file storage allow your PCs to become "cogs" to be swapped in and out as necessary when PC hardware fails.
The server computer's hardware should be able to withstand minor faults (ECC memory, RAID, redundant power if you can afford it) and should be warranted with a service contract with an appropriate response level for the expense, per hour, of downtime.
Having the remote users work right on desktop machines via RDP means that you don't have "file sync" issues to worry about, and you can button the VPN down to allow only the RDP protocol into the LAN. (Windows Small Business Server can do such an RDP scenario w/ no VPN server or VPN client software.)
You really don't need the added expense and complexity of a "standby server". You just need good, tested backups, and a solid server to begin with. (Come back when you have 100 users and we'll talk about a "standby server"-- and even then it probably won't make sense unless your cost-per-hour for downtime is very, very high.)
There's lots of good info on Server Fault to help with this kind of setup, but you really should get a local professional (with some good references) to come on-site and help you get started with it. It sounds like you'd want to do a lot of the work yourself, so look for somebody who is interested more in getting you started down the right path versus billing and billing and billing you. (There are consultants / contractors who work that way, but they're harder to find.)
You'll be tempted to scrimp on backup. Don't. Read that "Tao of Backup" web site. It's, admittedly, a sales pitch and a bit dated, but it's all correct. Same goes w/ the UPS-- don't scrimp on that, either.
You'll get other nice stuff, too-- group policy and Windows Server Update Services (to allow you to control update distribution on your PCs), just to name a couple of things. Depending on what you're using for DNS and DHCP right now, you may end up with nicer to manage solutions for them, as well. You'll get the ability to do real per-user / per-group file permissions. Yay, security!
Personally, I wouldn't be able to sleep at night w/ files stored on PCs and users having "file sync" issues. I'd want to get that cleaned up ASAP.