This setup may, or may not, be completely anonymous, depending on a whole bunch of factors, some extremely subtle. Adding a VPN to Tor basically never improves anonymity, though. Exactly how someone would trace you back to your real IP is in many cases more about how you use Tor, than Tor itself.
You should always use a secure connection (HTTPS) when visiting websites as it prevents this type of attack, regardless of if you're using Tor or not. Facebook (along with many other websites) use HTTPS to provide end-to-end encryption that the exit relay cannot read.
I believe the traffic is encrypted 8 times (not including the TLS link crypto): 3 times along the client's circuit, 4 times along the onion service's circuit, and once more for the end-to-end encryption from the rendezvous handshake.
Client ─── A ─── B ─── C ─── Z ─── Y ─── X ─── Onion
│ ^ ^ ^ ^ ^ ^ ^ │
The tor-spec.txt you linked to is a more-or-less up-to-date description of how Tor works. There may be minor divergences between that document and the running code (which makes the codebase the definitive specification), but for almost any purposes you'll be wanting it for, it is sufficient. In particular, it describes the use of Ed25519 and Curve25519 in ...