Do all non-functional requirements need a specific metric and measurement?
No. They just some form of verification, which is sometimes trivial. For example, an NFR might be "the application shall be based on the Microsoft stack" which is pretty easy to check.
That being said, having clear acceptance criteria is almost always a good idea, and this could include metrics and measurements defined ahead of time, e.g. 98% of HTTP requests must receive a response within 3 seconds.
Would a NF maintainability requirement such as:
"Upgrade to a new software version shall leave all database and personal settings unchanged" be correct? Would a metric and measurement need to be added? How would a metric and measurement be added to such a requirement?
Eh, not really. Maintainability typically refers to the ability of the development team to maintain the system. The requirement you quoted specifies the ability of a user to access their personal settings after an upgrade. To me that is a functional requirement, as it requires system behaviors that are exposed to an end user.