Create: Never Trust the Client with Money

Strong params that leave money OUT

Module 08 built the mass-assignment story: a .permit allowlist stops a client from sneaking an unexpected key — like admin: true — into a create! call. Booking's version of that allowlist has a second job, more important than blocking an attack: it makes sure the client was never GIVEN the chance to set the two fields that decide what actually happens to a booking.