DM message reactions are unreachable on touch devices (hover-only react button)

Area: Messaging & chat (audit p4) · Surface: /messages/{id} (MessageController@showConversation) · Dimension: Law 5 — mobile first-class · Severity: major

On phones/tablets the per-message react (😊) button never appears, because it is hidden by default and revealed solely via `:hover` on the bubble. There is no tap/long-press fallback and no `@media (hover: none)` override. The whole 'add a reaction' affordance in DMs is dead on mobile — a feature that exists in markup but is impossible to invoke. Mobile is supposed to be first-class.

Evidence

templates/messages/conversation.php:291-293 renders the react trigger with inline `style="...display:none;..."`. The ONLY rule that reveals it is style.css:4642 `.msg-bubble:hover .msg-react-btn { display: flex !important; }`. grep for `@media (hover: none)` or any touch fallback for `.msg-react-btn` returns nothing. Touch devices fire no hover, so the button stays `display:none` forever.

Suggested fix. Add a touch fallback: under `@media (hover: none)` make `.msg-react-btn { display: flex; opacity: .6; }` (always visible) or wire a long-press/tap handler in conversation.php's react script to toggle the picker. Reveal the button on `:focus-within` too so keyboard users can reach it.

Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.