There is no vlan config for your router. How should it now that you want to use the wan port with tagged vlans ? I would expect that you need to configure the switch inside your router like you did with the ap, add 2 vlans, mark the wan port as tagged. Maybe part of that comes out of the box, but the wan port by default is untagged, I would think. So probably in the ap you get wan from an untagged port, route it to a tagged port, from there to a tagged port on your router, and the lan connection from your router goes via the same tagged port back to your ap.
The router is running snapshot, so there's no switch config anymore, just DSA. I use wan.1 and wan.2 in the ifname option to define the vlan (the port name is just wan, without the .1 or .2).
So DSA nows that wan is a tagged port just because wa.1 and wan.2 are used ?
I would try out /evaluate 2 things:
There is one cable between router wan and AP port 2, no hub, ... ?
What happens, if you configure your routers lan2 to be the port with vlan (so put lan2.2 in interface wan, and lan2.1 in interface lan ) and change the cable to lan port 2 ?
Great! Still I do not understand, how with dsa one can distinguish between a tagged and an untagged port. But it looks like luci support for this has been provided: