Epic: User profiles with persistent standards filter

What

Finish the #586 view: a logged-in user picks which standards they care about, and that selection is the default view across OpenCRE until they show all.

This is not a new catalog, not a private tenant, and not MyOpenCRE CSV-upload. Auth + persistence already exist. The saved list does not yet change CRE/search/explorer/GA pages.

Already shipped (#586)

• Google OIDC (/rest/v1/login, /callback, /user, /logout)
• users + user_resource_selection tables
• GET/PUT /rest/v1/user/resources
• MyOpenCRE ResourceSelector picker
• Server filter on GET /rest/v1/standards only (?all=true bypass)
• Empty selection = show everything; OpenCRE always kept
• Two flags, both off by default: CRE_ENABLE_LOGIN and CRE_ENABLE_MYOPENCRE

Chat login is separate: /rest/v1/completion is always @login_required. Production chat can already force Google login while these flags stay off.

The gap

apply_user_resource_filter runs only on /rest/v1/standards. The UI almost never consumes that list (the picker uses ?all=true). CRE pages load /id/{id} unfiltered. The old URL view (?applyFilters=true&filters=ASVS) is not hydrated from /user/resources. include_only= on the CRE API already exists and is unused by the frontend.

Child tickets

Added in follow-up comments / this project: https://github.com/orgs/OWASP/projects/60

Success

• Logged-in user with a non-empty selection sees only those standards (plus OpenCRE) on CRE/standard pages by default, with a visible “your view / Show all” control.
• Search and explorer respect the same view.
• Map Analysis dropdowns can be narrowed without losing a “all eligible” bypass (?all=true).
• Anonymous and shareable /cre/… URLs still show the full graph.
• Empty selection still means “show everything”.

Out of scope

• Private LLM / hosted MyOpenCRE tenant
• CSV import auth (#966)
• OAuth path rename (#963)
• Nest Agent (#1072)
• Rebuilding the picker or the User model

Context

• Closed parent: #586
• Deferred prune/GA: #1043
• RFC (broader MyOpenCRE, not this view): docs/rfc/user-auth-myopencre.md
• Filter helper: application/web/web_main.py apply_user_resource_filter
• Client URL filters: application/frontend/src/hooks/applyFilters.tsx

Start with application/web/web_main.py and apply_user_resource_filter, then inspect application/frontend/src/hooks/applyFilters.tsx and the existing user-resource endpoints. Trace how CRE, standard, search, explorer, and Map Analysis pages load filters. Done means selected standards are applied by default with a visible Show all bypass, while anonymous URLs, empty selections, and shareable /cre/ URLs retain their stated behavior.