fix: normalize high-level media comments

[subzeroid]

Summary

• Make Client.media_comments() consistently return list[Comment] when the public GraphQL path succeeds, including after public-session injection and retry.
• Expose Comment.child_comment_count while preserving the difference between a missing value and a real zero.
• Keep the low-level GraphQL helpers' raw-dict contract unchanged, fall back to the private API for malformed GraphQL comments, and avoid logging payload-bearing validation errors.

Fixes #424

Test coverage

• Added 20 focused regression tests covering XDT and legacy aliases, canonical-field precedence, login retry and fallback paths, raw helper compatibility, private reply counts, and sanitized validation failures.
• Full offline suite: 777 passed, 13 skipped, 35 subtests passed.
• Live read-only verification: authenticated public GraphQL and private comment paths returned Comment models as expected, and child_comment_count matched the raw private response.
• Coverage audit: 30/30 changed paths covered (100%).

Pre-landing review

No P0, P1, or P2 findings remain after independent coverage and adversarial reviews. Ruff, mypy baseline, Bandit, strict documentation build, dependency audit, formatting, and diff checks pass.

Design review

No frontend files changed.

Plan completion

No committed plan file exists. The diff is limited to the four files required for #424, and all requested behavior is covered.

Test plan

• Public GraphQL success returns Comment models.
• Login-required retry normalizes results; unavailable injection falls back to private v1.
• Malformed GraphQL payloads fall back without exposing payload values in logs.
• Private and GraphQL reply counts preserve positive, zero, and missing values.
• Low-level GraphQL chunk, paginator, and public-wrapper helpers still return raw dictionaries.