fix: resolve 5 PR review blockers for comments v2

1. Reply HTMX target: server sends HX-Retarget/HX-Reswap headers to
   insert replies inside parent comment's .replies-container div
2. Empty thread swap target: always render #comments-list container
   even when no approved comments exist
3. Reaction hydration: add _annotate_reaction_counts() helper that
   hydrates reaction_counts and user_reacted on comments in
   get_context(), comment_poll(), and single-comment responses
4. HTMX error swap: return 200 instead of 422 for form errors since
   HTMX 2 doesn't swap 4xx responses by default
5. Vary header: use patch_vary_headers() instead of direct assignment
   to avoid overwriting existing Vary directives

Also fixes _get_session_key() to handle missing session attribute
(e.g. from RequestFactory in performance tests).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

templates/blog/article_page.html

@@ -146,6 +146,7 @@
   {% if approved_comments %}
     {% include "comments/_comment_list.html" %}
   {% else %}
+  <div id="comments-list" class="space-y-8 mb-12"></div>
   <div class="mb-12 p-8 bg-grid-pattern text-center">
     <p class="font-mono text-sm text-zinc-500">No comments yet. Be the first to comment.</p>
   </div>