@hspindel 

A port should be untagged in only one VLAN, that is the VLAN you want that port belong to. Also, its PVID should be set to the VID of that untagged VLAN. In your case, the port on the switch connected to the router should be untagged in VLAN1 with PVID = 1. It looks as if that’s already the case, but remove that port from VLAN20. You have set the switch to do inter-VLAN routing which is good. However now, your switch’s VLAN interfaces (SVIs) 192.168.1.238 and 192.168.2.238 are the gateways for local traffic in their respective VLANs. Therefore, your laptop’s default gateway should be 192.168.2.238, not 192.168.1.250, if you connect the laptop to a VLAN20 port with PVID = 20. If you connect it to a port in VLAN1 with PVID = 1, the default gateway should be 192.168.1.238. Your router at 192.168.1.250 does not route local traffic, never did. It routes only traffic to/from Internet. The default route that you have already set up on the switch tell the switch that. Also, you need to add the following static route to your router so it knows that the 192.168.2.0/24 network can be reached through the 192.168.1.238 SVI.

192.168.2.0   255.255.255.0  192.168.1.238   LAN

If you add more VLANs, a static route like that will need to be added for each VLAN. You do not need a static route for VLAN1, because your router is in VLAN1.

  @hspindel 

A port can be untagged or tagged in a VLAN. A single port can be untagged in one VLAN and tagged in another. Again it should be untagged in only one VLAN, but it can be tagged in many VLANs. Having a port untagged in many VLANs does nothing since you can set only one PVID on a single port.

If your wireless AP supports VLANs and is configured with VLANs, the switchport the AP is connected to should be tagged in each VLAN. You configure an AP with VLANs by associating its SSIDs with VIDs, for example SSID1 with VID = 1 and SSID20 with VID = 20. The AP will tags frames sent to the switch with corresponding VIDs. For example, if a wireless device connects to SSID20, than the AP will tag its ethernet frames with VID = 20. I have no experience with wireless bridges or extenders that work with VLAN-aware APs.

If an AP is not configured with VLANs, the switchport it is connected to needs to be untagged and with a proper PVID. All devices connected to that AP, including wireless bridges and extenders, will belong to only one VLAN. However this can be altered, for example by using MAC-based VLANs. In MAC-based VLANs, you associate MAC addresses of end-point devices with VIDs. MAC-based VLANs are difficult to maintain so I would not recommend them.

An unmanaged switch needs to be connected to a switchport that is untagged, same as a VLAN-unaware AP. All devices connected to that switch will belong to only one VLAN. If you have some devices that need to belong to another VLAN, you should replace that switch with a managed switch. Two managed switches that are configured with VLANs should be connected together with the connected ports tagged in all VLANs.

  @hspindel 

“What do you think about assigning device IPs to different subnets without using VLANs?  (Just assigning through DHCP).  My understanding is that the main thing I would lose is additional traffic on my net, which I really don't care about.”

I don’t know what benefits of it would be. There will be no traffic separation at L2. I don’t think your DHCP server would be able to serve IP addresses to more than one subnet in the same broadcast domain. I also do not think you will be able to create a gateway for additional subnets.

What is that "additional traffic" you’ve mentioned? From time to time, posts offering very unorthodox solutions appear. Do not be guided by them. They either have a very limited use or are totally wrong.