Raspberry pi with a second network interface… Running FreeBSD.
As to your other point… If you remove the Sim card from your telephone and then connect to a second router device that you carry with you… But we’re getting a little weird here…
Oh, I am/was there. I have two to three phones anytime on me, so I can route one through the hotspot of the other. Still the question if the second phone route everything through the VPN.
Edit: and GP asked specifically about Mikrotik, I think. They have L7 cap, but it's literally raw.
If only we could insert a firewall between our apps and the modems in our phones.