The few tutorials I read suggested a configured parent interface was unnecessary. But I can't think how else to control traffic across management VLAN 1.
I have not ever configured a Cisco switch so I might have misread the configuration information you posted. It seems to me you have misconfigured the switch. You need the port connected to the pfSense box to be a trunk port with it sending VLAN tags for every VLAN you are using. In pfSense you need VLAN interfaces for every distinct VLAN ID you are using. You then control traffic from VLAN 1 by using firewall rules on the pfSense interface with VLAN id 1. It looks to me that you have configured the switch to NOT send VLAN tags on VLAN 1 and VLAN 2 seems to be both tagged and untagged. However you need to configure it, the result is that you want the port connected to the pfSense box putting VLAN tags in transmitted frames for all VLANs. Maybe the VLAN 1 is special and you really should use another VLAN id to accomplish this.
I had it working today, for a few fleeting minutes. Then I did something and broke it again.
Time to stop random tinkering. Decide on a simple objective, make a simple change, document the change and then test that change brings things closer to your objective. Repeat as necessary.
It is very hard to help when someone reports "I made a few changes that I can't remember and now it is broken".
Does the noise from tcpdump mean it's my firewall rules blocking?
Impossible to tell without a reasonable sample. However it is unlikely because I think tcpdump shows incoming frames BEFORE firewall rule processing has occurred.