You should consider just using CleanBrowsing DNS to enforce safesearch since you seem (to me) to be in over your head at this point in time with dnsmasq, Pi-Hole, DoH, etc. Spend some time learning how to customize Pi-Hole and asking questions at the PiHole forums. If you want to go back to a router-based dnsmasq solution (e.g. using Diversion instead of PiHole), come back and ask those questions.
I'm not saying you should give up and abandon this thread, but I don't think your setup is in a good state at the moment since you seem to be trying random things. You'll get better PiHole support at their forums, and better ASUS/Merlin/Diversion support here. But if you implement something you don't fully understand, you'll panic the first time it breaks and you won't know why. Been there, done that.