Checking back the flop is fine, but so is betting out. At these more passive stakes, I'd probably go ahead & bet it, but there's really not a big advantage to either choice. But with my aggressive image & playing style, I get peeled by all sorts of middle pair/gutshot/KQ that just doesn't believe you junk, so I usually just go ahead & bet out.
You need to raise the turn much larger. A potsized raise is to $9, and you barely got half that size. This leaves you in awkward spots where you have to overbet the river to get all the money in, plus it gives villain odds
There's definitely room for a value bet on the river as well. Villain has $19.25 left behind, and I'd prolly bet $9. But if you had raised to $9 on the turn, villain would have $15 behind a $21 pot, so you'd have an easy shove for value.
As far his range for a turn call, who knows. He's an unknown at $25NL, so its pretty friggin' huge, and probably contains lots of mid-pair + gutshot hands, maybe some poorly played sets/2-pair, and of course some aces.