One more thought: when IPv6 addresses are given to machines in the network, they are typically exposed on the Internet including IoT devices with poorly-written firmware. So, at least on some routers, the default is to block incoming IPv6 traffic through a simple firewall rule. On my D-Link I remember having to disable this. Since you did not mention disabling a similar option in your detailed report, it is worth a check. This could certainly explain web-allowed-but-nothing-else-is behavior.
