ALB targets are unhealthy with Target.ResponseCodeMismatch. Direct checks show that the configured /health path consistently returns HTTP 302 to a login page, while the target group matcher accepts only HTTP 200. What is the best operational correction?

1. Disable health checks on all targets so ALB stops evaluating readiness.
2. Allow all ports from the internet in the instance security group before examining the response.
3. Use a dedicated readiness endpoint that returns the expected success code only when the application is ready, and configure the target group to check it.
4. Increase the healthy threshold without changing the endpoint or accepted status codes.