The first config, you have all the vlans assigned to vlan2, and thus your bridge ports should NOT include ether2 ???
Typically following this excellent article: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
The idea is one bridge, and all vlans associated to the bridge, and thus either remove bridge port 2 ( easiest fix ) or
add all the vlans to the bridge, and make the .88 subnet a vlan…
Set detect internet to none, its not useful in this scenario and could cause issues.
Set neighbours discovery to LAN, not all.
Since the wireguard connection is client for handshake…
What is the purpose for this router and wireguard… to connect to another MT router over wireguard??
or to a third party VPN provider, if the latter, then suggest the wireguard interface should be part of the WAN interface list.
It would appear from the diagram you simply need the other MT to act solely as an AP switch.
Suggest you also use one bridge
The only interface list item needed is lets say MGMT.
The only vlan requiring identification is the vlan where the AP gets its IP from ( trusted subnet ).
This is the only vlan requiring tagging on the bridge itself, the rest just flow in from ether1 to whatever lan port or wlan port they need to go out of.
If you do have a spare port on the AP, setup an ip address just for that port, OFF the bridge so the AP is accessible independently during configuration.