The latest GLi firmware includes an OpenVPN client and supports many common vendors. There are TOR versions for at least some of the devices, but I do not think these versions include the VPN.
There is a ‘clean’ version of software for most of the GLi devices (clean= similar to the OpenWrt delivered, no GLi gui) and you can build your own OpenVPN client, server or TOR device from there if you wish.
There are no devices from anyone that offer dual radios on 2.4ghz. There is one GLi that hopefully will offer dual band capabilities in the near future, but it’s one radio on each of the bands. A single radio works in the above scenario very well with one issue. If your configured STAtion is not available, the LAN side will hang. There are various methods well documented here and on OpenWrt to address this, the easiest and most reliable is to mod the switch function to kill\disable the STAtion side. Search. You can alternatively run a USB device for a second radio.