GRE over IPSEC - cannot reach clients

You need to read again what rplant did and understand it.

You can not “IP route” thru the GRE addresses they do not form a proper network they are just tunnel ends even if they have what looks like a network between them. You will find you can change to /32 non connected network IPs and they will work exactly the same. This is your confusion and its probably safer to write them as /32 so you aren’t tempted to believe they form a network.
The only thing you can ping from a gre tunnel IP is the other tunnel end or something your end.

To IP ROUTE thru the tunnel you need to put a proper network each end ON THE GRE INTERRFACE which is what rplant forming a proper /30 network.

Now you can IP ROUTE thru that network so going back to rdplant setup

OFFICE END (IP ROUTES 10.1.1.192/28 thru tunnel)
/ip address
add address=192.168.40.1/24 interface=gre-tunnel1
/ip route
add dst-address=10.1.1.192/28 gateway=192.16.40.2

HOME END
/ip address
add address=192.168.40.2/24 interface=gre-tunnel1

As Sindy said it you are tik to tik it’s much easier to use an IP-Tunnel just know that the two phases for ipsec on these are set by
/ipsec/profiles/default (phase 1)
/ipsec/proposals/default (phase 2)