I am not a dev, but I think the router and its firmware can already see the traffic before it's being sent to the OpenVPNclient where is being encrypted/decrypted, so, the router should be capable to apply QoS on the traffic before is being send to the OpenVPN client... (It must be possible, as it is already possible in other firmwares, i.e. Lede).
Besides, the router can already show all the running services/protocols and the transferred data in its statistics, so that means QoS can be applied on that traffic before the TUN interface (before the OpenVPN and its encryption/decryption).