The secret sauce is following the guide.
all your questions are already answered.
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Its much better not to saddle the bridge with dhcp responsbiilities default vlan pvid=1 is kept.
Just make vlan10 your management vlan which means all devices attached (switches, APs) etc get an IP on vlan10.
For MT devices, make a bridge, tag incoming port and bridge with vlan10 and done, if you are also carrying vlan 10 to other devices then assign tagging or untagging of etheports/wlans as required.
For non-MT devices,
the rule of thumb is default pvid of 1, is only removed if its an access port (where one needs to set a pvid of xx.
In this case, one sets pvid of xx and the port is ungagged for the vlan “U” . (typically one allows only untagged vlans or all frames (as some dont have such an option)
For trunk ports, one tags such ports with required vlans “T”, (and allow only tagged vlans), ingress filtering = yes.
For MT switches using Swos
VLAN SETTINGS
trunk ports–> vlan mode:enabled, vlan receive:any, Default vlanID:1, vlan header: leave as is
Access ports—> vlan mode:strict, vlan receive: only untagged, default vlanID:xx (whatever the vlan is for that port), vlan header: always strip
VLANs SETTING
PEr VLAN ID -------> TRUNK PORTs are :Leave as Is (for all vlans running through the port), not a member if a vlan is not running through that port.
Per Vlan iD ______> Access POrts are :Leave as is for the pvid vlan, Not a member (for all other vlans)