Fix download redirect: use wp_redirect() for external URLs

wp_safe_redirect() rejects external hosts not in WP's allowed list and
silently falls back to admin_url() — which is why /download/{id}/ was
redirecting to /wp-admin/ on a clean install. Switch to wp_redirect()
since the URL is explicitly user-configured.

projects-portfolio.php

@@ -112,7 +112,10 @@ function projects_portfolio_handle_download_redirect() {
             update_post_meta( $project_id, '_projects_portfolio_download_count', $download_count );
 
             // Redirect to the release ZIP on the project's host.
-            wp_safe_redirect( esc_url_raw( $download_url ) );
+            // Use wp_redirect() (not wp_safe_redirect()) because the destination
+            // is an external host the user has explicitly configured — wp_safe_redirect
+            // would reject it and fall back to admin_url().
+            wp_redirect( esc_url_raw( $download_url ), 302 );
             exit;
         } else {
             wp_die(