Keep the class schedule on the class itself so SMS and listings do not have to infer days and hours from sessions.
Expose nationalId aliases and enrollment counts on user list responses, and store admin notes on users, classes, and sessions.
Express/MongoDB backend with JWT auth, RBAC, S3 uploads, notifications, and scheduled jobs.