You're looking at the password policies for the org, but you most likely have Profile Password Policies defined which override it.
To ensure that the appropriate level of password security is used for
your organization, specify password requirements with Password
Policies settings for users assigned to a profile. Profile Password
Policies settings override ...
As you are accessing the API from the same Salesforce org, you can use SessionId, which should be the recommended approach. However, if you still wish to use Connected App and named credentials please follow the below step:
Create a Connected App with OAuth Scope of "Full Access" and "refresh token".
Create an Auth Provider with default ...
Salesforce as a provider does not support Password Authentication. Hence Named Credential with Password authentication on the same org will not work and it will throw an error as below:
You may use oAuth2.0 or any other authentication approach for ...