You need to register separate routes for each scenario you want to cover (ie, cat & tag, just cat, or just tag), all done in the single add_action call. The regex you have will support the comma separated tags.
The next thing to do is change how you set the 'term' parameter as part of the 'tax_query' array parameter. It’s expecting an array of strings, currently you are passing a single string of comma separated values (ie, 'tag1,tag2'). You can pass the result of using explode() to convert the string to an array.
You will also need to implement some conditional logic around setting the 'tax_query' array parameter based on what route is used.