Prod: enable CRE_ENABLE_LOGIN and CRE_ENABLE_MYOPENCRE for profiles

Parent: #1079 · Project: https://github.com/orgs/OWASP/projects/60

What

Turn on the two flags that already gate the profile UI and resource-selection API on opencreorg, then verify login chrome + MyOpenCRE picker work.

Both flags are required. Resource APIs no-op unless CRE_ENABLE_LOGIN and CRE_ENABLE_MYOPENCRE are truthy.

Why this is a ticket

Chat already has its own Google login (/rest/v1/completion is @login_required). The header Login button and /myopencre only appear when the flags are on. Enabling them is a prod config change, not a code change.

Do

• Set CRE_ENABLE_LOGIN=1 and CRE_ENABLE_MYOPENCRE=1 on Heroku app opencreorg (do not paste heroku config values into this ticket)
• Confirm Google OAuth secrets already used by chat still work for the header login flow
• Confirm LOGIN_ALLOWED_DOMAINS is * or includes the users we want (if it is a tight allowlist, the new Login button will 401 everyone else)
• After deploy: header shows Login; /myopencre is in nav; logged-in user can load and save /rest/v1/user/resources
• Confirm anonymous CRE pages still work (flags must not hide public graph)

Do not

• Do not paste secrets or heroku config dumps
• Do not compute gap analysis on production
• Do not expect CRE pages to filter yet — that is the other tickets in #1079

Success

A logged-in user can open /myopencre, see the standards checklist, save a selection, and round-trip it via GET /rest/v1/user/resources. CRE pages still show the full graph until the apply-view tickets land.

Start with the opencreorg Heroku configuration and the existing chat login flow at /rest/v1/completion; verify the required OAuth and LOGIN_ALLOWED_DOMAINS settings without exposing secrets. Enable both flags, deploy, and check the header Login button, /myopencre, and GET/ save behavior for /rest/v1/user/resources. Confirm anonymous CRE pages still show the full graph.