Meanwhile I did some experiment with alternative configuration (I hoped the problem would reproduce itself, but instead I get another problem).
I created a separate network (192.168.11.0), connected PI4 lan port to it with static IP, and connected its WAN port to my home network, with hope that either it won't work at all, or will work flawlessly.
The reality was more complicated 
Computer connected to the lan (both as static IP and with DHCP - when I enable DHCP on OpenWRT) connects and can ping everything (my home network, and internet).
Internet pings are frequently timed out, pings to my home network are very fast (<1ms).
DNS queries work.
Same behavior is observed when doing "diagnostic" from Lucy web interface.
When I try to open any site on the computer connected to the lan, it times out or opens very slow.
Changes relative to my original setup - upnp disabled, dnsmask and odhcpd started (or stopped, it doesn't matter).
Tried to put "wan" IP of PI4 into DMZ of my router - didn't change anything.
All connectivity is over wired network
This "test" configuration serves no practical purposes, but enables me to conduct experiments without taking internet down. I post "debug info" for this configuration, but honestly I am not sure it is worth to explore, as behavior is different compared to PI4-bridge combination.
root@OpenWrt:~# ubus call system board; \
> uci export network; uci export dhcp; uci export firewall; \
> head -n -0 /etc/firewall.user; \
> ip -4 addr ; ip -4 ro li tab all ; ip -4 ru; \
> ip -6 addr ; ip -6 ro li tab all ; ip -6 ru; \
> ls -l /etc/resolv.* /tmp/resolv.* /tmp/resolv.*/* ; head -n -0 /etc/resolv.*
/t
{
"kernel": "5.4.97",
"hostname": "OpenWrt",
"model": "Raspberry Pi 4 Model B Rev 1.2",
"board_name": "raspberrypi,4-model-b",
"release": {
"distribution": "OpenWrt",
"version": "SNAPSHOT",
"revision": "r15734-6934d30cf8",
"target": "bcm27xx/bcm2711",
"description": "OpenWrt SNAPSHOT r15734-6934d30cf8"
}
}
package network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd74:a7bd:d427::/48'
config interface 'lan'
option type 'bridge'
option ifname 'eth0'
option proto 'static'
option netmask '255.255.255.0'
option ip6assign '60'
option peerdns '0'
list dns '192.168.10.244'
option ipaddr '192.168.11.254'
config interface 'wan'
option proto 'dhcp'
option delegate '0'
option ifname 'eth1'
option hostname '*'
option macaddr 'F8:A0:97:E6:40:2E'
option broadcast '1'
package dhcp
config dnsmasq
option domainneeded '1'
option boguspriv '1'
option filterwin2k '0'
option localise_queries '1'
option rebind_protection '1'
option rebind_localhost '1'
option local '/lan/'
option domain 'lan'
option expandhosts '1'
option nonegcache '0'
option authoritative '1'
option readethers '1'
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
option nonwildcard '1'
option localservice '1'
option ednspacket_max '1232'
config dhcp 'lan'
option interface 'lan'
option dhcpv6 'server'
option ra_slaac '1'
list ra_flags 'managed-config'
list ra_flags 'other-config'
option ra_management '1'
option start '100'
option limit '150'
option leasetime '12h'
config dhcp 'wan'
option interface 'wan'
option ignore '1'
config odhcpd 'odhcpd'
option maindhcp '0'
option leasefile '/tmp/hosts/odhcpd'
option leasetrigger '/usr/sbin/odhcpd-update'
option loglevel '4'
package firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config rule
option name 'Support-UDP-Traceroute'
option src 'wan'
option dest_port '33434:33689'
option proto 'udp'
option family 'ipv4'
option target 'REJECT'
option enabled 'false'
config include
option path '/etc/firewall.user'
config include 'miniupnpd'
option type 'script'
option path '/usr/share/miniupnpd/firewall.include'
option family 'any'
option reload '1'
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP qlen 1000
inet 192.168.10.238/24 brd 192.168.10.255 scope global eth1
valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
inet 192.168.11.254/24 brd 192.168.11.255 scope global br-lan
valid_lft forever preferred_lft forever
default via 192.168.10.250 dev eth1 src 192.168.10.238
192.168.10.0/24 dev eth1 scope link src 192.168.10.238
192.168.11.0/24 dev br-lan scope link src 192.168.11.254
broadcast 127.0.0.0 dev lo table local scope link src 127.0.0.1
local 127.0.0.0/8 dev lo table local scope host src 127.0.0.1
local 127.0.0.1 dev lo table local scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local scope link src 127.0.0.1
broadcast 192.168.10.0 dev eth1 table local scope link src 192.168.10.238
local 192.168.10.238 dev eth1 table local scope host src 192.168.10.238
broadcast 192.168.10.255 dev eth1 table local scope link src 192.168.10.238
broadcast 192.168.11.0 dev br-lan table local scope link src 192.168.11.254
local 192.168.11.254 dev br-lan table local scope host src 192.168.11.254
broadcast 192.168.11.255 dev br-lan table local scope link src 192.168.11.254
0: from all lookup local
32766: from all lookup main
32767: from all lookup default
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 state UNKNOWN qlen 1000
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 fe80::faa0:97ff:fee6:402e/64 scope link
valid_lft forever preferred_lft forever
6: br-lan: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 state UP qlen 1000
inet6 fd74:a7bd:d427::1/60 scope global
valid_lft forever preferred_lft forever
inet6 fe80::dea6:32ff:fe9f:7e16/64 scope link
valid_lft forever preferred_lft forever
fd74:a7bd:d427::/64 dev br-lan metric 1024
unreachable fd74:a7bd:d427::/48 dev lo metric 2147483647
fe80::/64 dev br-lan metric 256
fe80::/64 dev eth1 metric 256
local ::1 dev lo table local metric 0
anycast fd74:a7bd:d427:: dev br-lan table local metric 0
local fd74:a7bd:d427::1 dev br-lan table local metric 0
anycast fe80:: dev br-lan table local metric 0
anycast fe80:: dev eth1 table local metric 0
local fe80::dea6:32ff:fe9f:7e16 dev br-lan table local metric 0
local fe80::faa0:97ff:fee6:402e dev eth1 table local metric 0
multicast ff00::/8 dev br-lan table local metric 256
multicast ff00::/8 dev eth1 table local metric 256
0: from all lookup local
32766: from all lookup main
4200000001: from all iif lo lookup unspec 12
4200000003: from all iif eth1 lookup unspec 12
4200000006: from all iif br-lan lookup unspec 12
lrwxrwxrwx 1 root root 16 Feb 11 22:58 /etc/resolv.conf -> /tmp/resolv.conf
-rw-r--r-- 1 root root 47 Feb 13 11:35 /tmp/resolv.conf
-rw-r--r-- 1 root root 96 Feb 13 11:35 /tmp/resolv.conf.d/resolv.conf.auto
/tmp/resolv.conf.d:
-rw-r--r-- 1 root root 96 Feb 13 11:35 resolv.conf.auto
==> /etc/resolv.conf <==
search lan
nameserver 127.0.0.1
nameserver ::1
head: /t: No such file or directory
root@OpenWrt:~# mp/resolv.* /tmp/resolv.*/*
-ash: mp/resolv.*: not found
