WireGuard, Caddy, Yeastar, DrayTek, Cudy 5G CGNAT

Project Overview:
I need a highly skilled network engineer to resolve complex routing, VPN, and VoIP infrastructure issues. Generic or AI-generated answers will not be accepted.

Current Environment:

KSA Site: Cudy P2 5G (behind CGNAT) -> DrayTek Vigor 2915.

Egypt Site: Yeastar S20 PBX (Fiber).

VPS: Contabo (Germany) running Docker, Caddy, WireGuard. Site-to-Site is working.

Required Subnets: 192.168.10.0/24, 192.168.2.0/24, 192.168.100.0/24, 192.168.50.0/24.

Strict Requirements:

Must provide a mandatory 7-day stability guarantee before final milestone release.

Access will be provided via AnyDesk / UltraViewer ONLY.

To apply, you MUST answer these 4 specific questions directly in your proposal:

1. Port 443 Conflict & Device Access:
The previous developer mapped VPS port 443 (via Caddy) directly to the DrayTek Web GUI, which breaks DrayTek's Smart VPN. How exactly will you resolve this using Caddy so that the VPN functions properly, Yeastar Linkus can still register via the DDNS hostname, AND we have stable Web GUI access to the Cudy P2, DrayTek, and Yeastar PBX both internally and externally?

2. Smart VPN Automation (Split-Tunneling):
I want to leave the VPN (IPsec/IKEv2) ON 24/7 on my phone. How will you configure the DrayTek routing so that when I enter the KSA office and connect to the local Wi-Fi, local KSA traffic automatically takes priority without routing conflicts?

3. Linkus Auto-Switch:
How will you configure the Yeastar S20 SIP/Network settings so the Linkus app automatically uses the Local PBX IP on the office Wi-Fi, and seamlessly switches to the DDNS endpoint on 5G outside, entirely bypassing the VPN?

4. 5G CGNAT & VoIP Stability:
To prevent audio drops, VoIP packet fragmentation, and UDP session timeouts over the 5G WireGuard tunnel, what specific WireGuard parameters (e.g., MTU, MSS clamping, Keepalive) will you apply?