I already searched the whole internet (maybe it was just 50% but you got it ) to find some luci guide for that - no way. You could try to search on YouTube.
But the best way would be just starting to learn how to configure using config files. Will take some time, but it’s good for understanding how the whole thing works. Every change in a config file will be reflected in luci as well!
You can tag vlans with eth0.<vlanid> and assign these into a newly created bridge which you can create via luci → network → interfaces → devices tab → add device
Call it br-wlan0 and add eth0.<vlanid> under its bridge devices its important you check the checkbox keep up the bridge this is so to avoid crashing joining a null network if the bridge was down or went into promiscuous mode, then create a new network interface or edit a existing network interface via luci → network → interfaces → interfaces tab replace the device for br-wlan0, the protocol has to be dhcp client or unmanaged.
Go to luci → network → wireless, and edit the wireless network and change the device to your new or edited interface.
but lets start at the very base because i think you want to learn vlans fully right?, then i want to know what things you already did with your upstream router, is it openwrt? Has it vlan support?, is there also a managed switch involved, i need to get the picture here
Then you still need to forward vlans via the managed switches
Luckily i also have a Zyxel and a Netgear switch so it can also work with screenshots.
What you actually want for your first switch on the port connecting to the netgear is like this screenshot you can keep the pvid to 1 because you may want to access your flint and netgear also on the same subnet for management.
You tag port 1, to sent it back to pfsense, and tag port 6 (in my screenshot, this should be your network port for the netgear), also don’t get itimidated by the first row called excluded just leave it don’t touch it, its kinda a confusing option which changes automaticly i had the first time also issues understanding it😄
For other vlans you can do exact the same.
On your netgear this would look kinda like this screenshot:
You don’t really have to do anything with vlan 1 because you want it to be part of your maintenance network, though you might call them different, for security aslong vlan 1 is not part of the membership port you should be fine, in this case your flint only tags it, but the untagged ports/end ports are your wifi from there it should not be reaching vlan 1 because OpenWrt should block it.