notifications (likes/mentions/connections) returns `API error code -1` on v0.6.4 — blocks seeing who liked/followed

### Summary

On `xiaohongshu-cli` v0.6.4, the `notifications` command fails for **all** types with a generic API error, so there's no way to see **who liked a comment** or **who newly followed** the account. This is the only data source for that, so the use case is fully blocked.

### Environment
- xiaohongshu-cli **0.6.4** (installed as `uv tool`, command `xhs`)
- macOS, cookie-source: Safari
- Account is logged in & valid: `xhs status` and `xhs whoami` return correct profile (authenticated: true)

### Repro
```
$ xhs notifications --type likes
ok: false
error:
code: api_error
message: 'API error: {"code": -1, "success": false}'
```
Same result for `--type mentions` and `--type connections`.

### What still works (so it's not auth/cookie)
`search`, `search-user`, `read`, `comments`, `sub-comments`, `like`, `comment`, `follow`, `reply` all return `ok: true` with this same cookie.

### Possibly related
`xhs user ` and `xhs user-posts ` return the **same** `code -1` error, while search/note endpoints work. These user-profile endpoints may now require an `xsec_token` that the CLI isn't passing (XHS tightened user-page access). The notifications failure may share the same root cause.

### Use case / why it matters
A common workflow is: someone likes your comment or follows you → you open their profile → engage with their related posts. Right now `notifications` (the only way to get the liker/follower list) is unusable.

### Ask
Fix the `notifications` endpoint (likely a signature/param or `xsec_token` change on the XHS side), and ideally `user` / `user-posts` too. Happy to provide more debug output (`-v`) if helpful.

Reproduce the failure with `xhs notifications --type likes`, then inspect the `notifications`, `user`, and `user-posts` entry points and compare their request parameters with the working commands. Done means notifications works for likes, mentions, and connections, with the user and user-posts endpoints addressed if they share the same cause.

Written by the indexing model from the issue text.