Two Ingresses on one host do not merge annotations. nginx applies the annotations of a single ingress per host, so the separate /oauth2 object silently dropped the auth_request on the app ingress: every request fell through to the backend and ComfyUI answered 404 for the site root. Move /oauth2 and / into the same ingress, so the auth annotations and both paths belong to one object.