fix: address final review findings — lint, Node engine, remaining-work doc, create-rule validation

functions/package.json

@@ -2,7 +2,7 @@
   "name": "functions",
   "private": true,
   "type": "module",
-  "engines": { "node": "20" },
+  "engines": { "node": "22" },
   "main": "lib/index.js",
   "scripts": {
     "build": "tsc",

functions/src/index.ts

@@ -16,6 +16,8 @@ export const onBookingCreated = onDocumentCreated(
   async (event) => {
     const booking = event.data?.data()
     if (!booking) return
+    if (typeof booking.date !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(booking.date)) return
+    if (typeof booking.time !== 'string' || booking.time.length === 0) return
 
     const db = getFirestore()
     await db