As @VampireTap wrote, this address assignment is not correct:
/ipv6 address
add address=::1 from-pool=dhcp-pool interface=bridge
You should do like what you already did for the IPv4 /ip address counterpart, and add /ipv6 address entries for the individual vlan-local and vlan-main interfaces, not to the parent bridge. Your "fix":
only configures one of the two interfaces.
Also, you should turn on the vlan-filtering=yes flag on the bridge. And I don't know if it's intentional or not, but currently vlan-local is not in the LAN interface list, so IPv6 forwarding will not work for devices on that interface with your current FW rules.
The CRS309 has a weak CPU, you should consider enabling Fasttrack on both the IPv4 and IPv6 firewall for significantly better routing performance, see the standard defconf firewall rules for 7.22.1.
Enabling Fasttrack is also necessary when you later want to turn on L3 hardware offload. You CRS has a switch chip that supports L3HW with NAT and firewall, with help of the Fasttrack rules: L3 Hardware Offloading - RouterOS - MikroTik Documentation