Admin override is now selector-based: choose class, teacher, section and/or date, and matching assignments appear below. Teachers/students still use server-side CNIC + Authenticator scope and cannot expand their own access.