fix(channel): load the banner without a referrer

Google's image CDN refuses a banner request that carries a Referer from our origin - every
time, not only under load (measured: 6/6 refused with it, 8/8 served without). The banner
<img> now sends none, as ui/Avatar does for the same CDN; the comments that blamed a
transient burst throttle are corrected.

frontend/src/components/ChannelPage.tsx

@@ -79,11 +79,11 @@ export default function ChannelPage({
   // where the channelScoped Feed portals ITS toolbar (via the overridden PageToolbarSlot below), so
   // the toolbar lands under the tabs inside the fixed band rather than in the scroller.
   const [chromeSlot, setChromeSlot] = useState<HTMLDivElement | null>(null);
-  // The banner URL is valid, but googleusercontent intermittently throttles it when the channel
-  // page fires the banner + avatar + ~16 thumbnails in one burst — the request is dropped and the
-  // browser then NEGATIVE-CACHES the miss, so the banner stays broken even though a retry would
-  // succeed. So on error we retry a few times with a cache-buster (forcing a fresh request), and
-  // only fall back to the blank bar if it keeps failing (a genuinely dead URL — rare).
+  // The banner comes from Google's image CDN, which refuses any request carrying a Referer from our
+  // origin — every time, not only in a burst (measured 2026-09-26) — so the <img> sends none
+  // (`referrerPolicy`, as ui/Avatar). A load can still drop, and the browser NEGATIVE-CACHES the miss,
+  // so on error we retry a few times with a cache-buster (forcing a fresh request), and only fall
+  // back to the blank bar if it keeps failing (a genuinely dead URL — rare).
   const MAX_BANNER_RETRIES = 3;
   const [bannerAttempt, setBannerAttempt] = useState(0);
 
@@ -335,6 +335,7 @@ export default function ChannelPage({
                 // browser's negative cache (googleusercontent accepts an extra query param).
                 key={bannerAttempt}
                 src={`${ch.banner_url}=w1707${bannerAttempt ? `?r=${bannerAttempt}` : ""}`}
+                referrerPolicy="no-referrer"
                 alt=""
                 className="w-full h-full object-cover object-center"
                 onError={() => {