[seniorThrowaway]

>Part of the roadmap involved divorcing the routing from the wifi completely

This is the move. Let's you upgrade the different parts of the network separately. I have 3 components, an N150 router/fw/DNS/VPN box with 2.5GB NICs running OPNSense. A cheap but surprisingly good 2.5GB managed switch, and a cheap wifi 6 VLAN tag capable wifi access point.

[ssl-3]

Yes, it definitely is the right way to do stuff. It's not arduous and it represents a highly functional and sustainable level of separation.

It wasn't always practical (dedicated, plain PoE access points of unobtrusive shapes were once rather expensive), but these days it's completely approachable and usable.

If I may ask: Why a 2.5GB switch instead of, say, 10GB? I know 10GB over copper is a mess due to the heat generation, but my own perfect vision of an upgrade involves using optics instead.