I don't really know why your original config wasn't working, and not sure what to do... I'll keep thinking about it, but hopefully someone else will know.
It shouldn't matter, as long as it is properly configured (and it sounds like it is, based on the rest of your network functionality). I am familiar with EdgeOS, too, but I don't really think we need to dig into that side of the equation since we know your other AP is working (I assume that is running the standard Unifi firmware).
Just for grins, what managed switch(es) are you using? There have been problems with Unifi and DHCP when used with non-unifi routers (i.e. EdgeRouters or other ones entirely) -- mostly in the realm of the APs, but sometimes the switches have been implicated.
I do have an EdgeSwitch, but both of the APs are entering the EdgeRouter via an unmanaged TP-Link switch. At first I thought that would be an issue, but the original AP is working fine so I don't think that's it?
I'd eliminate all unmanaged switches. It probably isn't the issue, but there are many reasons why tagged networks should never be sent through an unmanaged switch -- most importantly that the behavior is undefined.
I plugged the OpenWrt AP directly into the router, and no change. Base (br-lan) network is working fine, both VLAN networks won't let any devices connect.
Yeah, I didn't think that the unmanaged switch was actually causing issues in your network currently because you have your other AP working through that switch. But it is generally bad practice to use unmanaged switches with VLANs and some switches will cause major issues.
I can't help but think that it doesn't like doing VLANs on the bridge itself (as if the bridge is almost like an unmanaged switch), but I have zero proof to back that up, and my idea earlier to try to use eth0 based VLANs definitions didn't work. So I'm a bit at a loss here, but I'm really curious to know about the actual root-cause of the problem and the optimal solution.