I use TP-Link Omada EAP-650's with the OC200 controller (there is a new version of the controller that is supposed to be better) and OpnSense as a router. Grab a POE switch and run wired cables if at all possible, yes they can mesh... wired > wireless and they still need power. With POE they are easy to ceiling mount, I have 2 and can access my wifi from 1/2 a block from home with one mounted near the front door and one near the back. You can use an app or the web interface, you can also forgo the controller and run the software on an always on computer.

Devices that combine the wifi and router are underpowered, designed to be replaced in 2 years or so, and don't get updated enough to truly protect a network in the AI age which is where OpnSense is amazing. The Omada series allows you to literally drop in an extra AP or replace an old one, adopt and apply the setup, and be off and running. Combined with a managed switch and you can create separate vLAN's that will isolate devices until they touch the router and then you can decide what to do with it.