wget --spider on 127.0.0.1:8000 verifies the Tailscale
sidecar's network namespace is forwarding to the backend
(controller shares the ts container's network ns).
start_period=60s covers Tailscale auth + tailscaled boot.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>