refactor(formatter): split generated ownership boundary

[MintsInc]

What does this PR do?

Keeps the generator-owned formatter surface (Metadata, format_and_print, and output) in src/formatter.rs while moving the hand-maintained rendering implementation and tests to src/formatter_ext.rs.

It also registers the extension module for native and browser builds and repoints rate-limit rendering helpers to the hand-maintained module.

Motivation

The Pup generator overwrites src/formatter.rs from a vendored snapshot. That can remove newer handwritten helpers and signature changes during code generation, which currently prevents the generated downtime commands in #759 from compiling.

This split establishes the same generated/handwritten ownership boundary already used elsewhere in the client and preserves existing formatter behavior.

Additional Notes

No dependencies or user-visible behavior change.

Verification:

• cargo build
• cargo fmt --check
• cargo clippy -- -D warnings
• cargo test formatter_ext::tests (85 passed)
• Full cargo test: 1,852 passed; five unrelated shared-environment HTTP tests failed against unused.local and passed when rerun individually
• cargo audit: reports pre-existing advisories for h2 and rsa, plus a yanked chacha20; this PR does not change Cargo.lock

Checklist

• The code change follows the project conventions (see CONTRIBUTING.md)
• Existing formatter tests moved with the implementation and pass
• Documentation is unchanged because the CLI surface and behavior are unchanged
• All CI checks pass (pending)
• Code coverage is maintained

Related Issues

Unblocks #759.