Under the assumption that your provider routes all your IPs through your main IP address (for my provider this is the case) you can just assign the additional IP addresses inside the VMs that are connected to the bridge of your host.
Main IP: 126.96.36.199
Additional IP: 188.8.131.52
One thing I do occasionally is to completely block the WebGUI port from the outside and tunnel it via SSH.
To do so you have to have SSH access to the proxmox machine.
Now you use SSH to tunnel the port to your local machine:
ssh -L 8006:<machine-ip>:8006 -N <youruser>@<machine-ip>
Add bridge: I am not sure whether adding a bridge is possible without rebooting. One thing you could try is to restart the debian networking service, but I am not sure whether this works or if this has any side-effects on proxmox. To do so you could run service networking restart
my current setting is the following. I have two public IP addresses. One is assigned to the physical host where Proxmox VE is installed on. The other one is assigned to a pfSense VM inside of Proxmox (connected to the vmbr0). I can ping both public IPs from the outside.
I do not have a server at Hetzner, but perhaps this works for you.
In comparison to your configuration:
I do not have a iface entry for eth0 (so the only place eth0 is mentioned is the bridge_ports eth0 entry)
Additionally I have the entry pointopoint <your Gateway-IP> for the vmbr0