Thank you for your answer! It must have been almost the same time when I found a solution, but I cannot explain, why it helps. The solution was to add the following interface to “br-lan”: eth1.1
This adds vlan 1 to the eth1 interface. I choose eth1, because the lan1-port, which the other AP is connected to, sits behind eth1. Where did I find that out? Check this command:
# ip link | grep " lan"
5: lan0@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP mode DEFAULT group default qlen 1000
6: lan1@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP mode DEFAULT group default qlen 1000
7: lan2@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP mode DEFAULT group default qlen 1000
8: lan3@eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP mode DEFAULT group default qlen 1000
9: lan4@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-lan state UP mode DEFAULT group default qlen 1000
So I do not know, if the documentation really shows, how OpenWRT/TurrisOS works: https://docs.turris.cz/hw/omnia/omnia/#network-interfaces
eth0 and eth1 seem to be equal, but TurrisOS gives me a different impression. What backs my theory up, is that in Recovery Mode 5 (ssh access at 192.168.1.1) you can only connect, if you plug the cable into lan4. This makes sense, because this port has a dedicated backend (eth0) on the SoC.
Anyway, this is my currently working br-lan from /etc/config/network:
config interface 'lan'
option type 'bridge'
option proto 'static'
option ip6assign '60'
option gateway '192.168.5.254'
list dns '192.168.5.254'
option _turris_mode 'managed'
list ipaddr '192.168.5.1/24'
option ifname 'eth1.1 eth2 lan0 lan1 lan2 lan3 lan4'