Apply saved standards selection on CRE and standard pages

Parent: #1079 · Splits #1043 §1 · Project: https://github.com/orgs/OWASP/projects/60

What

A logged-in user with a non-empty saved selection (GET /rest/v1/user/resources) should see that set (plus OpenCRE) as the default view on CRE and standard pages.

Today the selection is stored and the picker works, but /cre/{id} still loads the full graph. Server filter only hits GET /rest/v1/standards. The old URL filter (?applyFilters=true&filters=…) and the unused include_only= query on /rest/v1/id/… are the two existing hooks.

Implementation notes (pick one, do not invent a third store)

Preferred: reuse existing machinery.

• A (frontend): after login, if selection is non-empty, hydrate applyFilters / filters= from /user/resources (same applyFilters.tsx / DocumentNode path).
• B (backend): pass selection as include_only on get_CREs / node fetch (include_only_nodes already filters linked standard names).

Empty selection must remain “show everything”. OpenCRE is always kept.

Also on this ticket: view chrome

Do not bury the control only on /myopencre.

• On CRE/standard pages, show the active view (chips or one-line “Viewing: ASVS, CWE”)
• “Show all” / bypass equivalent to ?all=true (session still logged in, graph unfiltered)
• Deep-link / anonymous behaviour is #1084 — do not bake the profile into every public URL

Success

• Logged in, selection [ASVS, CWE] → CRE page hides SAMM/NIST/… links by default
• “Show all” restores the full node without clearing the saved selection
• Empty selection → full node
• Tests cover logged-in filtered, logged-in empty, anonymous full

Related

• Filter helper: apply_user_resource_filter in application/web/web_main.py
• Client: application/frontend/src/hooks/applyFilters.tsx
• Picker: application/frontend/src/components/ResourceSelector/ResourceSelector.tsx
• Existing deferral: #1043

Start with apply_user_resource_filter in application/web/web_main.py and the filtering path in application/frontend/src/hooks/applyFilters.tsx; review ResourceSelector.tsx for the saved-selection behavior. Choose one of the documented frontend or backend approaches, then add coverage for filtered, empty-selection, and anonymous cases. Done means CRE and standard pages show the saved view, preserve OpenCRE, and provide a Show all bypass without clearing the selection.