Someone mentioned above, and so I ask: have you given banana-pi r1 with openwrt a try? Would that setup be simpler than the current one with VLAN and netplan?

Speaking of netplan: I didn't quite catch head or tail of it.

What does it do and why is it required (in the context of the setup).

For ex:

  ethernets:
    enp2s0f0:
      dhcp4: no # only dhcp6 allowed?
                # or, is dhcp now handled by wifi-ap?

    enp2s0f0.10:
       id: 10
       link: enp2s0f0 # down-link?
       addresses:
         - 68.69.70.71/24 # is this modem's public-ip subnet?
                          # or, could be anything?
       gateway4: 68.69.70.1 # modem's public-ip?
    enp2s0f0.20:
       id: 20
       link: enp2s0f0 # up-link?
       addresses:
         - 192.168.0.1/24 # subnet for the internal network?
                          # what does dhcp for this one?

The managed-switch NATs traffic? Or, you mean to say that rpi4 does? Or, am I misunderstanding how all of this actually works?

Thanks.