My setup is a bit extreme, but here are my guardrails:

1. All users have the same UID's on every system. I'm 1000, wife is 1001, son is 1002, daughter is 1003. All these exist on all systems. Our primary group is "family" (gid 10000). Our files are all owned by user:family. This matters because we let them have access to the share of things like home movies and pictures, and I have a TrueNAS with an NFS mount that their user folders rsync to nightly for backup. If you wanna get crazy, you can put in a whole LDAP/freeIPA setup, but that's a lot (and I did all that as a learning experience).
2. They don't have the account passwords. I have their password, and if they want to use it, the wife or I have to type the password. When we want them off, superkey+L to lock the computer, and if they reboot it comes to a login screen.
3. If you really go this route, and go the whole LDAP thing, you can also tie that into apps like Jellyfin. I have a huge library of movies and shows, but there's a folder called "KidMedia" and I literally manually symlink things to that folder if I want them to have access. I set up the phones/tablet with their own jellyfin accounts, and when they log in they only see their media. I also NFS mount that share, so for the same reason, they can watch stuff on VLC from the computer with access control. We also do that with nextcloud, so we can use nextcloud talk to chat internally. The tablets/phones have built in android controls, so the idea is once they're on their device, they're free within the ecosystem I set up and they don't enter credentials other than device unlock.

In that case, I agree with the others and say leave this up to the router - not only is it far more easier to set up, it gives you/your kid the freedom to switch between distros/OSes, and you can even swap computers without worrying about having up the controls all over again.

A friend of mine was in the same situation as you (he's also a Linux nerd), and he ended up with the router thing, and after extensive research, he decided to get a Synology router as it had all the features he was after (mainly limiting access times, monitoring and reporting). See: https://www.synology.com/en-global/srm/feature/device_content_control

And for extra filtering, you could also set the upstream DNS on the router to a filtering service such as Cloudflare for Families, AdGuard DNS Family etc.