I am a software engineer with a question that probably will sound silly to a network engineer... but I prefer to ask in case there is a solution.

My main Mikrotik Router is setup as such:
ether1: WAN1 [Cable modem]
ether2: WAN2 [5G Hotspot]
ether3: LAN Mikrotik AP with available ether ports

the setup above is functional. But I think I would get a better 5G signal if I could physically move the 5G Hotspot near the existing AP. The problem is that I only have one wire, and I do not want to add an extra wire.
So here is my question:
Is there a way to connect the 5G Hotspot to the AP and feed the traffic back to the main router without creating a security hole? In other words I am trying to split a wire to carry both WAN and LAN... This sounds impossible... Do I need a VPN type of setup to achieve this?

Very possible and pretty safe (depends on what's the danger), the thing you're looking for is VLAN. The idea is that you'll have virtual interface on top of real one and packets send/received using this interface will be wrapped in a way to be recognized as belonging to this virtual network. On main router, this new interface will be your WAN2 instead of ether2. On AP you'll just connect this virtual interface to ethernet port where 5G Hotspot will be connected.

Exact steps depend on what config you have now. On AP you'll probably need this:

https://wiki.mikrotik.com/wiki/Manual:I ... ess_Ports)

On main router either something similar (if LAN consists of more ports) or just (if LAN is only on ether3 and there's no bridge):

https://wiki.mikrotik.com/wiki/Manual:Interface/VLAN

Ok thank you - I set up some VLANs to separate my Main/IOT/Guest traffic so I am familiar with the concept. However, I did not realize I could tag the WAN traffic also. I will read the pages you referenced and come back if I have more questions.