A Tunnel and WARP path look healthy and one internal app still fails

Edge access works, yet the app sees no identity because an internal redirect path in NGINX loses the header after the first location match.