Whilst I was aware that Wireguard is a PtP tunnel and everything shoved in at one end (when AllowedIPs is configured accordingly) comes out the other, but still today I learned that you don't actually need any tunnel IPs on a Wireguard interface. Just having the correct routes on both ends into the respective tunnel interfaces is enough to make traffic flow bi-directionally between two remote clients across one central VPN server, not using up a single IP address for transport o.O