Session# 1: API design first — endpoints, status codes, error shapes 1Hr
Before we write code we draw the API. Resources, verbs, statuses, error envelopes — the contract you are committing to.

Session# 2: Project setup — Express, TypeScript, env config, logger 1Hr
A clean starter that you can re-use for every future project. Linting, formatter, env vars, structured logging — set up once, used forever.

Session# 3: Postgres schema design + Prisma migrations 1Hr
Model the domain. Pick the right relationships. Generate the first migration and run it locally with Docker.

Session# 4: CRUD endpoints with proper validation 1Hr
Build the create / read / update / delete handlers. Validate input with Zod. Handle the failure cases that always trip up beginners.

Session# 5: JWT authentication + protected routes 1Hr
Sign-up, log-in, protected endpoints with middleware. The auth pattern most production teams actually use, demystified.

Session# 6: Tests that catch regressions 1Hr
Vitest + supertest. Integration tests that hit a real test database. Tests you will actually keep running on every push.

Session# 7: Rate-limiting, security headers and observability 1Hr
Helmet, rate-limit, request IDs, basic OpenTelemetry. The boring boxes you have to check before going live.

Session# 8: Deploy to production + handover 1Hr
Push to Render or Railway, hook up a managed Postgres, configure secrets, write a one-page README. Your API is live.