yes that's all correct.

1. yes

2. yes, robots.txt works too - there are numerous ways to have the same effect. personal preference comes into it, plus one may be easier than another in your site/CMS. The reason I use noindex is that any page on my site could be accessed by https - so I prefer to dynamically throw noindex into any page that is accessed that way.

yes, generally you would noindex your about us, contact us, privacy, terms pages since these are rarely searched and in fact are so heavily linked to internally that they would rank well if indexed.

all search results should be noindexed - google wants to do the search

definitely NOT blog/category pages - these are your gold content!

I also noindex any URL accessed by https

Well, for a start, its very hard to see traffic figures for long-tail queries - by definition there are thousands of variations that may get only a search or two each month!  I'd focus on finding the keywords that make you money - the long tail will follow if you write good content and have a great natural link profile (varied anchor text)

Find the money keywords using adwords, then optimize your site for those.

Also try the "trick" query of adding a /* to the URL.

site:domain.com/*

I always compare these results with the plain site:domain.com - it's conjecture but I believe the /* is showing the really indexed pages (primary index) and the other shows supplemental index. No-one really knows of course, but I track the percentage of one over the other as a way of measuring google's trust of your site. The numbers are relative, not absolute, but I use a yardstick of 20-30% as being good.

YMMV

the safest route is to "noindex, follow" any page that is requested by https - this also squashes duplicate content when the user accesses non-cart pages using https...