Personally, I would do this in docker. That way you can have clearer separation between services and networks. But it’s not a hard requirement.

I would just do it, as you wrote. For example, on the account of jellyfin server, configure the tailscaleA client, then wireguard client, etc. Set those up as separate user services/processes/system services if root permissions needed and that’s it. Then on other services set the needed connections separately.
It might be handy to set up traefik, so things served via vpns can go through the same routes as local traffic, so you use the same path as your users do

When you have a service that serves something on a port, you are not limited to only one connection. It can be accessed through different clients, the only needed part is that those clients connect to their respective vpn networks and pass the traffic correctly

I don’t see a need for a separate device for that routing