Wireless drivers by default don't touch 802.1Q headers ... so if they receive frame with such header on one side (either radio or CPU side), they will pass it to the other side. So what you have to do is to bridge wired and wireless interface on each of SXT and make both interfaces (wired and wireless) trunk ports. To get management access through one of VLANs, make bridge port tagged member of selected VLAN, create vlan interface (with appropriately set VLAN ID) and use that interface for management (add appropriate IP address and route, allow MAC access for IP-less winbox access, etc.)

Technically it's not even necessary to make bridge vlan-aware, it'll jzst pass frames between ports without looking at 802.1Q frames (the rest, including vlan interface, still needs to be done). The only thing you loose with bridge not being vlan-aware is ability to filter traffic per VLAN and per port ... in your particular use case this may not be necessary.