fix: remove noreferrer from payment links to preserve Referer header

WATA DDoS Guard blocks requests without Referer (403 error).
Removed noreferrer from window.open and <a> tags on payment URLs.
noopener alone is sufficient for security (prevents window.opener access).

src/components/blocking/ChannelSubscriptionScreen.tsx

@@ -10,7 +10,7 @@ function safeOpenUrl(url: string | undefined | null): void {
   try {
     const parsed = new URL(url);
     if (parsed.protocol === 'https:' || parsed.protocol === 'http:') {
-      window.open(url, '_blank', 'noopener,noreferrer');
+      window.open(url, '_blank', 'noopener');
     }
   } catch {
     // invalid URL, do nothing

src/pages/AdminPayments.tsx

@@ -228,7 +228,7 @@ export default function AdminPayments() {
                         <a
                           href={payment.payment_url}
                           target="_blank"
-                          rel="noopener noreferrer"
+                          rel="noopener"
                           className="btn-secondary px-3 py-1.5 text-xs"
                         >
                           {t('admin.payments.openLink')}

src/platform/adapters/WebAdapter.ts

@@ -203,11 +203,11 @@ export function createWebAdapter(): PlatformContext {
     },
 
     openLink(url: string, _options?: { tryInstantView?: boolean }) {
-      window.open(url, '_blank', 'noopener,noreferrer');
+      window.open(url, '_blank', 'noopener');
     },
 
     openTelegramLink(url: string) {
-      window.open(url, '_blank', 'noopener,noreferrer');
+      window.open(url, '_blank', 'noopener');
     },
 
     async share(text: string, url?: string): Promise<boolean> {