Linked Presentation: Knowledge Expansion and Counterfactual Interaction for Reference-Based Phishing Detection