I am happy with it.

and Android devices only have one VPN slot enabled, I cannot use something such as Tailscale for encryption.

I solved a similar situation with a tailscale subnet router . a tailscale subnet router is a tailscale node that exposes the non-tailscale network to the tailscale network. This way I am able to access one of my routers (and its PBX) from all tailscale nodes. The android phone has only tailscale as a VPN. If i pay for mulvad I can have the rest of the traffic go over a mullvad node.

doesn’t really help you here though, unless you install protonVPN on the pi and add that as a tailscale exit node.

a wireguard tunnel over a forced NordVPN tunnel will mean that all his traffic will flow all the way to the NordVPN node and all the way back for a LAN connection.

a properly configured wireguard tunnel is harder to configure than a tailscale network with a mullvad exit node. (I think)

a wireguard tunnel can only connect one device to the Jellyfin Server (or router if it supports it)

You can also add a second network interface to the computer that needs to access the jellyfin server over LAN.

If you are willing to swap to mullvad then you can also install tailscale. You can then choose to connect to your jellyfin server (over LAN) or (over tailscale-wireguard tunnel over LAN) while the rest of the traffic flows through mullvad.

What the f

Change the port.