Correct rules that are factually wrong or out of date

Part of #2124.

These rules tell an agent to do something current guidance or the tree itself contradicts.

Rule	Problem
`security/security.md:61` enforce minimum password complexity	NIST SP 800-63B drops composition rules for length and a breached-password check
`backend/http.md:61` headers MUST be Hyphenated-Pascal-Case	field names are case-insensitive (RFC 9110); HTTP/2 and HTTP/3 send them lowercase
`frontend/ux.md:32` give every interactive element an `aria-label`	redundant where visible text already names it, and an agent following it can break WCAG 2.5.3, Label in Name: the name must contain the visible label ("Save changes" on a "Save" button passes, "Submit" fails)
`backend/errors.md:57` never retry an external 4xx	429 and 408 are retryable; `backend/edge.md:48` itself sends 429 with `Retry-After`
`data/data-migration.md:57` a NOT NULL column without a default locks the table	on a table with rows it fails; the stated reason is wrong
`data/data-quality.md:129` TypeScript interfaces as typed validation	interfaces are erased at runtime and validate nothing
`backend/grpc.md:83` health protocol "required for Kubernetes probes"	containers dropped Kubernetes (#2099)
`data/data-quality.md:103`, `:117`, `:132`	examples from a camera catalogue: lens weight, mount type, manufacturer + model + variant

Done when