fix: resolve 5 PR review blockers for comments v2

1. Reply HTMX target: server sends HX-Retarget/HX-Reswap headers to
   insert replies inside parent comment's .replies-container div
2. Empty thread swap target: always render #comments-list container
   even when no approved comments exist
3. Reaction hydration: add _annotate_reaction_counts() helper that
   hydrates reaction_counts and user_reacted on comments in
   get_context(), comment_poll(), and single-comment responses
4. HTMX error swap: return 200 instead of 422 for form errors since
   HTMX 2 doesn't swap 4xx responses by default
5. Vary header: use patch_vary_headers() instead of direct assignment
   to avoid overwriting existing Vary directives

Also fixes _get_session_key() to handle missing session attribute
(e.g. from RequestFactory in performance tests).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

apps/comments/tests/test_v2.py

@@ -90,14 +90,14 @@ def test_htmx_post_returns_comment_partial_when_turnstile_passes(client, _articl
 
 @pytest.mark.django_db
 def test_htmx_post_returns_form_with_errors_on_invalid(client, _article):
-    """HTMX POST with invalid data returns form partial with HTTP 422."""
+    """HTMX POST with invalid data returns form partial with HTTP 200 (HTMX 2 requires 2xx for swap)."""
     cache.clear()
     resp = client.post(
         "/comments/post/",
         {"article_id": _article.id, "author_name": "T", "author_email": "t@t.com", "body": "   ", "honeypot": ""},
         HTTP_HX_REQUEST="true",
     )
-    assert resp.status_code == 422
+    assert resp.status_code == 200
     assert "HX-Request" in resp["Vary"]
     assert Comment.objects.count() == 0