"created policy from zone WAN to zone LAN for SSH port 22"
Did you select the VIP as the destination? If you aren't familiar with FortiGate, it might make sense to create a regular firewall rule to allow the traffic. But, the destination needs to be the VIP itself.
Other than that, try with 0.0.0.0 as the external IP in the VIP(this requires you to select an interface other than 'any')
This looks too complicated...as I posted I run the same setup as you - FritzBox to the internet, LAN1 to WAN1 on FGT, an intermediate network like your 192.168.1.x, "exposed host" on FB. Works very well.
Check carefully that you have put the VIP as the destination address into the policy 'wan1' -> 'lan'.
Do not specify a port translation even if it's port 22 to port 22. If you do, ping won't work (as it doesn't use ports) and you could have the impression that the VIP isn't working. Narrow down your security in the policy.
Follow @brycemd's advice and use the wildcard '0.0.0.0' for the external address in the VIP. It will match whichever public IP the FB will have at any time.
Let the FB do the DynDNS provisioning - it monitors the WAN line and will notify the DDNS server reliably.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.