Cool list, my fav is "9. Log in with email, not username", that can be achieved with:

<input type="email" autocomplete="username email" required ...>

and if you also have username:

<input type="username" autocomplete="off" required ...>

I wish to read more about non-password use cases.

Also, fwiw, modern browsers support various form of validations, so maybe these rules should be adapted to reflect that, instead of re-implementing the wheel with client-side js.

<input type="password" placeholder="Enter your password" minlength="8" autocomplete="new-password" required ...>