hmm, so on the flint 2 you keep wan untouched correct?, I have seen people before being confused about the wan section since it has a vlan entry.
^ these entries are only if you want the router to replace the isp router in this case fritzbox (isp settings)
in br-lan, if you edit the DSA bridge you have the tab vlan bridge filtering did you use the vlans there?
Be aware that it isn't recommended to use multiple bridges, you want it simplified as much as possible by using a single one, and you also don't want to access bridge child vlan devices in concurrent bridges on the OpenWrt forums they told me to not do, because when DSA got implemented it wasn't made for this intention, and it can cause unexpected effects like loops, this depends also how well it is implemented, it maybe now works, but as they told me it wasn't their intention, it can also future break(!).
I assume you use only untagged ?, if tagged is involved you need a second vlan aware device which can manage the tagged vlan, since tagged vlans are not ment for destination ports, more as passthrough, untagged however cease to not exist after the current port and in OpenWrt basicly also behaves as PVID for that port, you have also primary vlan id as checkbox this only indicates more priority over the current untagged vlan, in the end only one untagged vlan can be used per port, for tagged vlans there can be more but these are not for the final destination port these can also be combined with untagged ports just fine.
If that logic makes sense to you, then I'm very interested to have a look into the configuration for:
/etc/config/network
/etc/config/firewall
/etc/config/dhcp
Also... I have seen this confusion aswell:
People who read the isp settings on their isp site or in isp router, and then think their downstream router needs to use these vlans or pppoe, this is wrong, the isp router does only use it to get internet, these vlans are not sent downstream, often aswell also not in bridge mode scenarios unless it is explicitly stated by isp.
Often bridge mode just applies some kind of DMZ to the router, so it is just fine the router uses dhcp as wan with no vlans, this can be reflected by the hops when performing a tracert in cmd in windows, or traceroute in linux, the isp router still appears as hop.
I hope this can give some insight or helpfull clues to get you started 