Issues fixed after first activation attempt:
- DHCP DNS now points to each VLAN gateway
- DNS redirect rules cover all VLANs
- VLAN interfaces added to LAN firewall list
- NAT masquerade for VLAN→AdGuard traffic
CSS326 switch configured via SwOS.
MikroTik backup saved.
Ready to enable VLAN filtering when convenient.