refactor: make Model::formulas private, expose read-only accessor

Previously `pub formulas: Vec<Formula>` allowed any code to call
`model.formulas.push(formula)` directly, bypassing the dedup logic in
`add_formula` that enforces the (target, target_category) uniqueness
invariant.

Making the field private means the only mutation paths are
`add_formula` and `remove_formula`, both of which maintain the invariant.
A `pub fn formulas(&self) -> &[Formula]` accessor preserves read access
for the UI and tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/ui/formula_panel.rs

@@ -36,7 +36,7 @@ impl<'a> Widget for FormulaPanel<'a> {
         let inner = block.inner(area);
         block.render(area, buf);
 
-        let formulas = &self.model.formulas;
+        let formulas = self.model.formulas();
 
         if formulas.is_empty() {
             buf.set_string(inner.x, inner.y,