You should have both resistors in the LED circuit. R1 (in my picture) limits the current from the power supply through the LEDs, and R2 limits the current from the Arduino pin through the transistor Base/emitter junction (which is very like an LED with a 0.7V voltage drop, and does NOT self-limit current.)
I would think powering the Arduino from 12V (assuming it's a real 12V, and not an unregulated supply at 17V or so!) would be ok in this case since you'd only be powering the AVR, and it wouldn't take much current. If you were going to power the LEDs as well on the AVR side of the regulator, it would cause more power through the regulator, and be more of a problem.)