First, the schematic is not complete, since it is only based on the observation of the external layers. The circle markers with 0-9/A-Q labels in the schematic are vias going to internal layers, and they match the yellow dots with the corresponding labels on the PCB layouts. If you have some time and the required electronic knowledge, this is something you can try to investigate
In order to locate things inside the schematic, I propose you to use the schematic external frame row/column position: for example, the main AR9331 U1 chip is located in E4-F5 and SPI FLash chip U3 is in E2.
Yes, there are a lot of unused pins on the AR9331, but they are not all available GPIOs. Some of them have dedicated functions, like the second RF interface connected to GND in area G4, or the unused additional Ethernet ports located in D4.
There are some unused GPIOs used for other TP-Link models (TL-MR3020) located in D5, but they are not accessible since they are located beneath the AR9331 chip.
So the only available pins usable for GPIOs are the ones we already know: those located in E3: GPIO11 (RESET_SW), GPIO7, GPIO6 (LDO, which is actually !USB_OC for USB overcurrent indicator), GPIO29, GPIO8 (USB_POWER) and GPIO27 (LED3); those located in G4-5: GPIO28, GPIO13 to GPIO17, GPIO0, GPIO1 and of course the TP_IN/TP_OUT LVTTL UART pins.
But most of them are tied either to GND or VCC by a pull-up/pull-down resistor, and most of them are used as boot-time configuration switches, so you must be careful as they cannot be set to the other state, at least during boot. This is why I tried to unsolder them one by one and tie them to the opposite level, and see if it prevents the router from booting
This is a second area of investigation, from my previous post, I guess that by changing these boot-time switches, it is possible:
to boot using the MDIO bus. Maybe also boot from USB? Bootstraping from ROM directly to USB (DFU ?) could be nice to recover devices with bricked U-Boot
that the normal 25 MHz crystal can be overclocked to 40 MHz
to select USB to work in host or device mode
to boot from SPI and probably also internal bootstrap ROM, if booting from SPI is optional
to disable SDRAM and choose between DDR1 or DDR2, or maybe select the correct SDRAM/DDR1/DDR2 config
Anyway, there are some very interesting points that can be seen from this schematic:
by removing J1, you can solder an external antenna
by populating R113, you can bypass the USB current-limited power distribution siwtch U6 and thus supply the TL-WR703N from the USB A connector
by removing R65/R68, you have access to the Ethernet 1/2 and 4/5 pairs to use as PoE to supply the device
by disabling first the USB in the kernel, you can use the USB_POWER signal to control the USB Host connector supply and thus control an external static relay without any soldering
Too many pocket WiFi routers / modules to list!