When does $\sqrt{a b} = \sqrt{a} \sqrt{b}$?
As you know, the rule $\sqrt{ab}=\sqrt a \sqrt b$ holds for some but not all combinations of $a$ and $b$. Explaining and remembering exactly which those combinations are is usually more trouble than it's worth, so usually the rule we remember is just
It is a sufficient condition for $\sqrt{ab}$ to equal $\sqrt a\sqrt b$ that $a$ and $b$ are both non-negative reals.
As you have noticed, this condition is not necessary, but that does not keep the rule from being useful.
For the purpose of rejecting your friend's fake proof, even the above version is more than you need; all you need to say is
The rule $\sqrt{ab}=\sqrt a\sqrt b$ does not always hold when we extend the $\sqrt{\phantom a}$ function to complex numbers.
It is not your task to prove that the rule fails in the particular case $a=b=-1$ (thought doing so is a simple matter of computation); it is the guy who wants to prove something who has the responsibility for only using rules he knows apply in the context he's using them in. After you've pointed out that the rule has been stretched beyond the domain we know it to work for, it's up to him to figure out whether he can come up with an argument that it should be valid here.
An alternate way to understand what is happening here is to note that $$ 1=e^{0i} $$ When we take the square root, we have $$ 1=\sqrt{e^{0i}} = \sqrt{e^{-\pi i}\times e^{\pi i}} $$ Notice that $e^{-\pi i}=e^{\pi i}=-1$.
Now, since we are working in polar form, we can evaluate the square roots consistently, arriving at $$ 1=e^{-\pi i/2}\times e^{\pi i/2} = -i\times i = 1 $$
Essentially, the problem lies in the "branch cut" that occurs with the square root operation - you must be careful with the evaluation.
To put it another way, $1=e^{2n\pi i}$ for all integer $n$, and the square root function has to respect its specific value (of $n$), as it can take multiple different values depending on that $n$. To get $1=-1$ as in the question, one must simultaneously use $1=e^{0i}$ and $1=e^{2\pi i}$.