"A Cheaper, Simpler Option

A few months after publishing this article, I came across a new router that gets most of the way toward achieving the goals of this project. For only $100 you can buy the Flint (GL-AX1800) and protect all your home network traffic with a WireGuard VPN. The caveats:

Your speeds will be limited to 500 Mbps due to the weaker ARM CPU.

The selective routing configurability is more limited; the best it can do is allow you to set up a "guest network" that isn't routed over the VPN and then you must configure your non-VPN device to use that Wi-Fi network."