The WifiWave2 adds a twist and another potential for unknown issues/bugs too 
. Your config looks right to me…but since
…so maybe a V7 bug?
While not directly related, this has some clue there might be some issues with vlan-filtering in V7 still lurking:
http://forum.mikrotik.com/t/v7-2rc2-and-v7-2rc3-is-released/155369/119
So the suggestion to just “admit-all” may not be bad, even if not same problem – at least to see if that gets DHCP working. If that works, open a support case since you shouldn’t need to use “admit-all”. There may be good reason to upgrade to 7.2rc3 on the RB5009, see
http://forum.mikrotik.com/t/fastpath-fasttrack-l2hw-l3hw-clarification/155333/3 related to FastTrack/VLANs/Bridges, with the specific on RB5009 covered here:
http://forum.mikrotik.com/t/v7-2rc2-and-v7-2rc3-is-released/155369/113
Not sure this be related to the DHCP not working nor “BAD”:
@anav may a bit too canonical when he say “BAD RULE”. If the point of VLAN is Layer2 isolation, but allowing Layer3 routing between the subnets, then “allow 192.168.0.0/16” firewall rule be okay/make sense. If IoT devices support/need local web management, you need to allow access Layer3 across VLANs, thus some “allow rule”. Now if you are going to allow full routing between VLANs, it a fair question why use them… IMO.