I'm assuming you mean sql 2005 here as SQL 2008 is only at sp3.

service packs are cluster aware for the database engine although you'd need to do the nodes for the tools.

we normally patch the secondary server, DR, before the primary as this avoids issues with backups failing due to different builds.