The root redirect rule matches Host(`PUBLIC_HOST`), not localhost. Curl with --resolve (bash) and Host header (PS1) so the health check sends the right hostname when verifying Traefik routing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>