Yo_2TB

This is old, but the diagrams in the first answer show you how to tag the ports to get the same setup as you described above:

https://superuser.com/questions/789294/can-i-send-a-wan-and-lan-connection-over-the-same-cable

Only issue with that is up time. Laptops have a tendency to go into sleep mode so if it does you lose DNS. Just gotta make sure it doesn’t do that. I know some are incredibly annoying with power settings and you can’t get rid of that behavior (Lenovo…).

Just disable dnsmasq or configure it to run on a different port.

https://wiki.archlinux.org/title/dnsmasq

It’s not an option even with a separate ONT. ATT Fiber made the asshole decision to lock it behind an 802.1x authentication with a cert that only their gateways have. There are ways to extract the cert but they are pretty involved.

It depends on what AdGuard option you’re talking about. There’s an AdGuard Home plugin for Asus routers running Merlin firmware, not the stock firmware. That’s the one equivalent to the AGH you can run on a Raspberry Pi.