Brute forcing 5-12 character WPA in practice ?

[epixoip]

1. Is hashcat (or oclhashcat) the best tool for the job? (cracking WPA/WPA2 handshakes).

Without question.

2. Is building a desktop/server system with multiple video cards truly the best solution? As opposed to using traditional servers (like a dell rack server, as we have several of these in the datacenter that could be repurposed already).

It is if your budget is that small. Your Dell servers cannot handle high-end GPUs. If you wanted to go the server route, you would need a specially-designed GPGPU server chassis that can handle AMD Radeon GPUs. There are only maybe four chassis out there that work really well for this.

3. Another option is running a small cluster on EC2. Does anyone do this with hashcat, is it practical?

Not a good idea. Too expensive, hardware sucks, performance sucks.