Provide secure Facebook authentication with my Server
1) Yes. It's enough. If your client (mobile app) has a token, it proves that a user authenticated to Facebook. So, you authenticated a user this way. However, it's not enough to authenticate a mobile app (about this, I will talk in #3).
2) Yes. It's encrypted both ways.
3) That's tough one. It's called remote attestation. There are A LOT of problems with this.
Before you go into this direction, you need to ask yourself two questions
Who are you protecting against?
How much am I willing to invest?
If you are protecting yourself against a student with very limited knowledge, who may write another mobile app which will use your server then you are fine with a signature.
If you are protecting against just a little bit more sophisticated software engineer (who can reverse engineer your application) - it won't be enough. This engineer can extract a private key from your application and use it to sign requests in his application.
You can read about remote attestation here and here.
Solutions which can protect you from simple reverse engineering are quite complex.
P.S. Regarding RSA library.
Look at this for Android:
And this for iOS