The bind + confirm two-step flow has timezone issues between Node.js (UTC on SCF) and MySQL (timezone +08:00) that cause bind_token to fail validation. Add POST /api/v1/device/mock-bind that does bind + confirm in one atomic step, skipping the token entirely. Only available when NODE_ENV != production. Update ble-connect and index page mock buttons to use mock-bind.