An AWS ALB OIDC flow loops (alb-oidc-callback-hostname-drift-after-proxy-change)

User login starts correctly, yet the flow never completes because the browser returns on a hostname the ALB auth action does not consider its registered callback identity.