I have a failing USB boot drive that is showing read errors and lots of bad sectors.
I have taken a backup and from the looks of it the files in the config directory are fine.

The server is currently up and running and I was thinking of moving to TPM licensing due to the issues I have with flash sticks over the years.

What is the minimum I need to copy over that will keep users, passwords, shares, array details? Is it just the config directory? If I make a new boot USB and then just overwrite is that enough?

Yes, the config folder is all you need. It holds everything specific to your server: array and pool assignments, share settings, users and passwords, network settings, plugins, Docker templates, the go file and the license key file. Everything else on the flash is the Unraid OS itself, and you get a fresh copy of that when you create the new USB.

Since you want to move to TPM licensing, I suggest this order:

1. Make sure the server runs Unraid 7.3 or newer and that TPM 2.0 is enabled in the BIOS (Intel PTT or AMD fTPM).

2. While still booted from the current USB, go to Tools > Registration and use Move License to TPM. This uses the license replacement flow, so the old USB license is retired when it completes.

3. After the move, copy the config folder again or make a new flash backup. The new TPM key file is saved in config, so your earlier copy does not have it.

4. Create a new USB with the USB Creator, using the same Unraid release you run now, then copy your config folder over the one on the new USB, overwriting it.

5. Boot from the new USB, check that Tools > Registration shows a valid license, and confirm the array assignments before you start the array.

If the old stick fails before you can do step 2, you can also create the new USB with your current config copy, boot from it and use Replace Key. With a TPM detected, the replacement goes to the TPM.

Because the old stick has read errors, I would not restore the new USB from a full flash backup, since a damaged OS file would carry over. A clean install plus the config folder avoids that. If you changed the boot options in syslinux.cfg, for example custom kernel parameters, or keep any of your own files outside the config folder, copy or redo those separately.

Once the license is on the TPM, a future USB failure only needs a new stick and your config folder, with no license transfer.