use `pf` to allow TCP traffic on specific port (from specific subnet)
apf takes precedence over pf, in which case, (Q) how do I change or work around that?


It's not about precedence; it's logical AND — those firewalls are independent to each other and you're invoking both of them. Even if Pf won't block connections you have specifically verified that socketfilterfw won't pass it.