serververs/network-transit ? reverse-engineered prompt

Build me a shell based IP transit setup for Linux that lets a server behind CGNAT get a real public IP through a secure WireGuard tunnel. I want a simple install flow where a user copies one command from a dashboard, pastes in their one time token, and the machine gets routed automatically with no manual WireGuard setup.

Please include a small command line tool called sv-transit that can install the tunnel and show whether it is up, plus clear scripts for provisioning, route changes, and status checks. It should work on VPS, bare metal, and containers with the right network permissions, and it should be safe enough for homelab use with good warnings about SSH access, root permissions, and firewall rules.

Keep it straightforward, Linux focused, and easy to run from the terminal. If anything is unclear, look up current WireGuard and Linux networking docs online and follow best practices.