busybox wget has no --max-redirect flag → it printed usage, so the probe never saw the 302 and R-IDP-01 falsely failed. Grafana verified live: /login/generic_oauth 302s to the Keycloak homelab authorize endpoint. Use 'wget -S' (dumps the 302 Location before follow).