Devlog #2 – SchoolPool

Spent the session auditing and tightening the SchoolPool backend on the Spark plan. I found that any user could self-grant verified/schoolAdmin/adminSchoolIds at doc-create, and a driver could rewrite any ride field. Plus ratings could target strangers and rideRequests could forge a driverId to push-spam anyone. Also, the school search was fully broken. So I fixed both of them! :P