diff --git a/sim/cluster0/lab-seeds/backend/src/bootstrap.php b/sim/cluster0/lab-seeds/backend/src/bootstrap.php
index ea17cf0..5bb2cbe 100644
--- a/sim/cluster0/lab-seeds/backend/src/bootstrap.php
+++ b/sim/cluster0/lab-seeds/backend/src/bootstrap.php
@@ -74,6 +74,7 @@ require_once __DIR__ . '/WireGuardAddressPool.php';
 require_once __DIR__ . '/WireGuardTrafficStats.php';
 require_once __DIR__ . '/RsshSessionProvisioner.php';
 require_once __DIR__ . '/RsshBastionProvisioner.php';
+require_once __DIR__ . '/AuthApproval.php';
 require_once __DIR__ . '/AuthTwoFactorPage.php';
 require_once __DIR__ . '/AnalyticsHead.php';
 
diff --git a/sim/cluster0/lab-seeds/backend/views/layout.php b/sim/cluster0/lab-seeds/backend/views/layout.php
index 671ab43..c919371 100644
--- a/sim/cluster0/lab-seeds/backend/views/layout.php
+++ b/sim/cluster0/lab-seeds/backend/views/layout.php
@@ -121,6 +121,18 @@
             </span>
           </a>
         </li>
+        <li>
+          <a href="/app/androidcast_project/monitor/"
+             class="nav-link"
+             aria-label="Monitoring"
+             title="Monitoring">
+            <span class="nav-icon nav-icon--monitor" aria-hidden="true"></span>
+            <span class="nav-text">
+              <span class="nav-label" data-i18n="nav.monitor">Monitoring</span>
+              <span class="nav-desc" data-i18n="nav.monitor_desc">Grafana dashboards — cluster health, alerts, exporters.</span>
+            </span>
+          </a>
+        </li>
         <li>
           <a href="<?= h(Auth::basePath()) ?>/?view=live_sessions"
              class="nav-link <?= ($view ?? '') === 'live_sessions' ? 'active' : '' ?>"
diff --git a/sim/cluster0/lab-seeds/backend/views/two_factor_challenge.php b/sim/cluster0/lab-seeds/backend/views/two_factor_challenge.php
index e81344f..f801d2c 100644
--- a/sim/cluster0/lab-seeds/backend/views/two_factor_challenge.php
+++ b/sim/cluster0/lab-seeds/backend/views/two_factor_challenge.php
@@ -39,11 +39,11 @@ $twofaQr = AuthTwoFactorPage::qrPayload();
   <form class="login-card" method="post" action="<?= h($auth) ?>/two-factor" id="twofa-form">
     <h1 data-i18n="twofa.title">Two-factor authentication</h1>
     <?php if (is_array($twofaQr) && !empty($twofaQr['qr_url'])): ?>
-      <p class="muted" data-i18n="twofa.hint_scan">Scan the QR code with your phone to approve this sign-in, or enter the 6-digit code below.</p>
+      <p class="muted" data-i18n="twofa.hint_scan">Scan with your <strong>phone camera</strong> (not Google Authenticator) to approve this sign-in on another device, or enter the 6-digit code from your authenticator app below.</p>
       <figure class="twofa-qr-wrap" id="twofa-qr-wrap">
-        <img src="<?= h((string) $twofaQr['qr_url']) ?>" width="160" height="160" alt="QR code — scan to approve sign-in on this device" class="twofa-qr">
+        <img src="<?= h((string) $twofaQr['qr_url']) ?>" width="160" height="160" alt="QR code — scan with phone camera to approve sign-in" class="twofa-qr">
         <figcaption class="muted">
-          Scan to approve on mobile
+          Phone camera → tap link → Approve
           <?php if (!empty($twofaQr['short_url'])): ?>
             · <a href="<?= h((string) $twofaQr['short_url']) ?>" rel="noopener"><?= h((string) $twofaQr['short_url']) ?></a>
           <?php endif; ?>
diff --git a/sim/cluster0/scripts/deploy-ac-broadcast.sh b/sim/cluster0/scripts/deploy-ac-broadcast.sh
index cc5703f..fb5c471 100755
--- a/sim/cluster0/scripts/deploy-ac-broadcast.sh
+++ b/sim/cluster0/scripts/deploy-ac-broadcast.sh
@@ -76,8 +76,10 @@ if is_primary_node; then
         mariadb -u root <<SQLEOF
 CREATE USER IF NOT EXISTS 'broadcast_svc'@'%' IDENTIFIED BY '${DB_PASS}';
 CREATE USER IF NOT EXISTS 'broadcast_svc'@'localhost' IDENTIFIED BY '${DB_PASS}';
+CREATE USER IF NOT EXISTS 'broadcast_svc'@'${CAST01_HOST:-cast01}' IDENTIFIED BY '${DB_PASS}';
 GRANT ALL PRIVILEGES ON broadcast.* TO 'broadcast_svc'@'%';
 GRANT ALL PRIVILEGES ON broadcast.* TO 'broadcast_svc'@'localhost';
+GRANT ALL PRIVILEGES ON broadcast.* TO 'broadcast_svc'@'${CAST01_HOST:-cast01}';
 FLUSH PRIVILEGES;
 SQLEOF
         log "broadcast: DB schema applied"