Chain links icon on the toolbar:
Any old 16 MHz crystal should do. I just grab whatever’s cheapest and haven’t had any problems.
You can get them anywhere that sells electronic components. Here in the US, I like Digikey if I’m in a hurry and want trustworthy parts. I’ve bought from Mouser also. Generally I haven’t noticed too much difference between the two but I will occasionally do comparison shopping if spending a lot of money or can’t find what I need on one or the other. Otherwise I buy from eBay or Aliexpress and wait for the shipping from China. Buying from the Chinese sellers ends up being significantly cheaper for small orders because shipping is free, whereas domestic shipping from Digikey or Mouser can cost more than the components order. Also, sometimes Digikey/Mouser have the minimum order set quite high and I’m just a hobbyist so I don’t need huge stocks of most parts. For larger orders the Digikey/Mouser shipping cost is not such a significant part of the cost and actually sometimes it ends up being about the same price for trustworthy parts from them that show up after a few days as it would be to buy sketchy parts that take weeks or even months to come from China.