Inline onclick='window.location=...' login redirects on SID/disk feature cards

Area: Files, photos, gallery, ansi (audit p5) · Surface: /files/detail/{id} (file detail SID/C64 feature cards) · Dimension: law1-polish · Severity: minor

These are non-semantic clickable <div>s wired with inline JS navigation. A div is not keyboard-focusable or operable by Enter/Space, so a logged-out keyboard user can see 'Log in to play' / 'Log in to emulate' but cannot activate it — and the inline handler is the legacy pattern the codebase is moving away from. The polished file-detail surface should route logged-out users via a real link.

Evidence

platform/templates/files/show-file.php:123 and :150 — `onclick="window.location='/login'"` on the SID-play and C64-launch <div class="fe-feature-card"> elements when the visitor is logged out.

Suggested fix. Render the logged-out state as an anchor (`<a href="/login" class="fe-feature-card">`) instead of a div with onclick, so it is focusable, keyboard-operable, and middle-clickable; drop the inline handler.

Filed by the automated tenant-app audit and adversarially evidence-verified. Status: verified. Open — not yet actioned.