@RonNaija , thanks for these comments.  Really helped me crystalize some key points in my understanding.  More importantly, your comments correctly shifted my attention to settings on the ROUTER, where the port was in the wrong mode for communicating with the VLAN-aware switch.  I've fixed my problem now, and everything works as I'd hoped!

I think I have a correct matrix of rules and behaviors now that seems consistent with the behavior I've seen (explains both the incorrect behavior and the correct behavior I now have).  I'll post it here in case it helps others.  And of course, if I got something wrong here, I'd be very grateful to have someone point out the error in my thinking!  And others will likely find it helpful to.  So please, shoot at this!

First some general rules for designing a network with VLAN-aware components:

VLAN Network Design Rules:

In my case, this last rule was the key.  My router had the port for VLAN4 set in "Access" mode, which (in my router's terminology) meant that it assumed the device on the other end was not VLAN-aware, and it was sending only untagged frames.  Changing the port to "Trunk" mode made everything work with the settings I have on the switch (which I'll show later).

Now, some general rules and behavior matrices for understanding what happens in the TP-Link switch:

TP-Link JetStream Switch: Rules for VLANs and Tags

TP-Link JetStream Switch: FRAME INGRESS (Frames coming into a given source port)

TP-Link JetStream Switch: FRAME EGRESS (Frames being forwarded to a given target port)

(and remember, by rule J3 above, ALL frames are tagged inside the switch, so for egress, there are only these three cases to consider...)

So applying these rules to my scenario, my settings needed to be:

VLAN4 (have to define this first):

• UNTAGGED Ports: 17-20
  • These are the ports that connect to the camera subnets, which are not VLAN-aware.  Rule ND3 says this has to be a dumb link, and therefore should not have tagged frames, so these ports must be UNTAGGED in this VLAN.
• TAGGED Ports: 21-24
  • Ports 21-23 connect to the Unifi WAPs, which are VLAN-aware, and port 24 connects to the router, which is also VLAN-aware.  Rule ND2 says VLAN-aware links need to use tagged frames on both ends, so these ports must be set as TAGGED in this VLAN.

VLAN1 (default):

• UNTAGGED Ports: 1-16, 21-23
  • Note that I've removed ports 17-20 and port 24 from Untagged ports in this VLAN.   These ports will now belong *exclusively* to VLAN4, which effectively partitions the network as I intended.  This is why I had to create VLAN4 first -- Rule J2 says every port must belong to at least one VLAN, so these ports had to be added to VLAN4 before they could be removed from VLAN1.
  • Note also that ports 21-23 are in both VLANs.  This is key, because this link will carry frames for both VLANs, and they Unifi WAPs will send traffic for the different VLANs to different WLANs (different SSIDs).
• TAGGED Ports: (none)

Port Config:

• Ports 1-16 and Ports 21-23 keep default configuration: PVID=1; Ingress Checking = ENABLED; Acceptable Frame Types = "Admit All".
  • The setting for ports 21-23 matters becuase the Unifi APs will send tagged frames for the WLAN that's associated with VLAN4, but for the other WLAN (that isn't associated with any VLAN), they will send untagged frames.  So, PVID must still be 1 here in order to keep those untagged frames logically in VLAN1.
    • Note that I could have done this a different way -- I could have set up the WLAN for the main network to require VLAN tags, and then all traffic on the switch<->WAP links would be tagged.  I could then have set Acceptable Frame Types = "Tagged Only".  Perhaps that would have been clearer, especially for explaining these rules and setup.  But functionally, it would make zero difference in my case, since I only have two logically-separate networks that I care about.  That I'm able to do it they way I did is perhaps a consequence of the default behaviors of the component I happen to be using-- if I had been using a different vendor's VLAN-aware WAPs, I might have had to do the tagged-only thing here...
• Ports 17-20, and port 24 change to:  PVID=4; Ingress Checking = ENABLED; Acceptable Frame Types = "Admit All".
  • For Ports 17-20, we must have "Admit All", since all incoming frames from the dump camera subnet will be untagged.
  • For Port 24, the setting doesn't really matter, because all frames from the router will be tagged with VLAN4.  So we could change to "Tagged Only", but it wouldn't change any behavior.

And that's it!  It seems relatively simple now, but it sure took a lot of thought and research to figure this out.  I wish TP-Link's Web Config portal and User Documentation did a better job of explaining the *basics* so you didn't have to try to find and study 6 examples (none of which seem to match your own scenario) and just infer the basic rules of behavior to guide you to the right settings....   Anyway -- I hope this helps others!  Thanks again for your help!