Well, it doesn’t matter if you configure the wireguard client on the router or the server.
Running your proxy at home instead of on the VPS makes it possible for you to terminate SSL at home, inside your LAN, which means no need for TLS pass-throughs.
nftables is recommended by Debian, but I suppose either one will work just fine.
I’m asking you to configure NAT on your VPS so as to forward traffic from the wider Internet, through your VPS into your wireguard tunnel. Obviously, I’m assuming you’re following security practices on the VPS so as to not compromise your home network. The configuration you have on your server is fine, since that’s meant for outbound traffic.
You can absolutely run a Wireguard client on your router, regardless of whether you are behind CG-NAT or not. It’s a different story if your router doesn’t even let you run extra software on top. That’s a different conversation.