Generated wireguard config with nat-pmp enabled in ProtonVPN panel, put keys and endpoints to my vpn client (gluetun docker image), used https://github.com/soxfor/qbittorrent-natmap image to interactively update port from qbittorrent settings on proton through natpmpc.

https://github.com/... - I've set up my docker-compose pretty much by this example (ignore "unreliability" feedback, OP probably has some issues upstream - image itself is working). If you are using this, remove all upnp/nat-pmp checkboxes from qbittorrent, this image is your nat-pmp client.

Speaking of clients: this setup is for sure extremely ugly, but native implementation of nat-pmp in libtorrent for some reason is not doing what's needed, maybe because qbittorrent tries to use upnp/nat-pmp simultaneously. What I see is an error message from upnp client ("no router found" - understandable) and complete silence from nat-pmp.