fix(admin-web): set no-referrer policy on cross-origin platform avatars

Platforms like Bilibili refuse to serve avatar images when the
Referer points at our admin origin, so the article publish status
panel and the media account cards now request avatars with a
no-referrer policy to stop the placeholder from showing instead of
the user's real avatar.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/components/ArticlePublishStatus.vue

@@ -267,6 +267,7 @@ function getAccountInitial(accountName: string): string {
                         :src="entry.avatarUrl"
                         :alt="entry.accountName"
                         class="article-publish-status__account-avatar-img"
+                        referrerpolicy="no-referrer"
                       />
                       <template v-else-if="getAccountInitial(entry.accountName)">
                         {{ getAccountInitial(entry.accountName) }}

apps/admin-web/src/views/MediaView.vue

@@ -362,7 +362,7 @@ async function refreshAll(): Promise<void> {
             <div class="media-card__head">
               <div class="media-card__identity">
                 <span class="media-card__avatar" :style="{ background: account.platformAccent }">
-                  <img v-if="account.avatarUrl" :src="account.avatarUrl" :alt="account.displayName" />
+                  <img v-if="account.avatarUrl" :src="account.avatarUrl" :alt="account.displayName" referrerpolicy="no-referrer" />
                   <span v-else>{{ accountInitial(account) }}</span>
                 </span>