Currently, I need an AX router that supports using AP + STA mode simultaneously. I can’t get ISP in my workspace unit, so I need to use the public workspace Wi-Fi. To increase security, I need a Wi-Fi router that can use one band as a Wi-Fi client (WAN) to connect to the workspace Wi-Fi, and another band to act as home Wi-Fi (LAN). The outgoing traffic will be secured by Wireguard (UDP) or OpenVPN (TCP), depending on the application type.

I’ve read some old threads stating that past Mikrotik Wi-Fi 5 products support this usage, but I’m not sure if the modern hAP ax series does. Some say it depends on hardware support.

Yes, but STA/main mode/ + AP/virtual same frequency/ !

On MT devices with dual radio (e.g, 2.4GHz + 5GHz) these are idependent abd can be configured in completely different manners. So yes, you can configure e.g. 2.4GHz radio as station and 5GHz radio as AP. And yes, the "uplink radio" can be stand-alone in L2 sense, so traffic has to be routed between it and the rest of interfaces. Again any of MT wireless devices can do it as they are running RouterOS.

Or, as @Trivolta writes, even using single radio with gotchas (not only the one already mentioned).