I think I solved my own problem. (Don’t you love that! 🙂
In my setup, the SSH server is on the same machine as the AFP share. So when creating the tunnel, instead of using:
ssh myname@serverWANaddr -L 2548:192.168.1.10:548
I need to use:
ssh myname@serverWANaddr -L 2548:127.0.0.1:548
Then, in the Finder, using -K allows me to connect to:
afp://localhost:2548
(It does take 15 seconds for the shares to load, but maybe something in the DNS resolution is causing that….)