Use Unraid's native Tailscale support. Add each Docker container to the Tailnet. You don't need split horizon DNS when using Tailscale, as the Tailscale IPs will work both on and off your LAN, as long as you're connected to Tailscale. Don't use a subnet router. Tailscale is peer-to-peer, so it's still going to connect directly over your LAN when possible (it won't route out to the internet then back)
For TLS, you could use the Tailscale built-in .ts.net subdomains. Should work out-of-the-box. Otherwise, to use your own domain, f you can't get access to Namecheap's API you could run acme-dns instead.
They already said they're using Tailscale, so this isn't needed. They can just use the Tailscale IP everywhere. On LAN it'll connect over the LAN, and away from home it'll connect over the internet. It comes with a
.ts.netsubdomains too.