Title: `xhs comments` returns `code=-1` API error on two tested notes (v0.6.4)

### Environment
- CLI: xiaohongshu-cli 0.6.4 (installed via `uv tool install xiaohongshu-cli`)
- Repo: [jackwener/xiaohongshu-cli](https://github.com/jackwener/xiaohongshu-cli)
- PyPI: 0.6.4 (no newer release available)
- OS: macOS 15.7.4
- Python: 3.11

### Steps to Reproduce
1. `xhs whoami --json` → `guest=false`, cookie valid
2. `xhs read --json` → `ok=true`, full note data returned
3. `xhs comments --json --xsec-token ` → exit=1, `api_error`, `code=-1`
4. `xhs comments --json --xsec-token ` → same result

### Expected Behavior
`xhs comments` should return comments for notes that are readable via `xhs read`.

### Actual Behavior
```json
{"ok": false, "error": {"code": "api_error", "message": "API error: {code: -1, success: false}"}}
```

### Tested Scenarios
- Two different notes (both readable via `xhs read`; note_id obfuscated)
- Both canonical explore URL and note_id forms
- With `--xsec-token` (token verified working via `xhs read`)
- Environment without HTTP proxies
- Cookie valid (`xhs whoami --json` → `guest=false`)
- All command output redacted — no token or sensitive value exposed

### Root Cause Assessment
`xhs read` works, but `xhs comments` → `get_comments()` at `xhs_cli/client_mixins.py:388`
calls `_main_api_get("/api/sns/web/v2/comment/page", ...)` which returns `code=-1`.
Likely the comments API endpoint or its request parameters no longer match the current
xiaohongshu API behavior. The available evidence does not yet distinguish an upstream
API change from a CLI request-signing, header, or parameter compatibility issue.

### Adjacent Issues (not same fault)
- [#60](https://github.com/jackwener/xiaohongshu-cli/issues/60): notifications endpoints return API `code=-1`
- [#62](https://github.com/jackwener/xiaohongshu-cli/issues/62): `sub-comments` is unavailable

### Suggested Fix
- Investigate `get_comments()` in `xhs_cli/client_mixins.py` (L388-442)
- Compare the `/api/sns/web/v2/comment/page` request against the working `xhs read` API call
- Check if request signature, headers, or payload format has changed

Start in xhs_cli/client_mixins.py at get_comments() (lines 388-442) and trace its _main_api_get call for /api/sns/web/v2/comment/page. Compare that request with the working xhs read API call, checking the signature, headers, and parameters. Reproduce the failure with both note_id and canonical explore URL forms; done means xhs comments returns comments rather than code=-1.

Written by the indexing model from the issue text.