fix CORS on webhook redirect: use redirect=manual, extract Location header

index.html

@@ -2419,6 +2419,7 @@
             try {
                 const res = await fetch(ORDER_WEBHOOK, {
                     method: 'POST',
+                    redirect: 'manual',
                     headers: { 'Content-Type': 'application/json' },
                     body: JSON.stringify({
                         product: product,
@@ -2435,9 +2436,18 @@
                     }),
                 });
 
+                // 3xx redirect — extract the Location header and open it
+                if (res.type === 'opaqueredirect' || (res.status >= 300 && res.status < 400)) {
+                    const location = res.headers.get('Location');
+                    if (location && location.startsWith('http')) {
+                        window.open(location, '_blank');
+                        return;
+                    }
+                }
+
+                // Non-redirect: try parsing the body for a URL
                 if (!res.ok) { console.error('Webhook error:', res.status); return; }
 
-                // Try to parse the response for a redirect URL
                 const ct = res.headers.get('content-type') || '';
                 let data;
                 if (ct.indexOf('json') !== -1) {