Add execution profile request workflow

docs/guides/portal-execution-profiles-handoff.md

@@ -99,6 +99,38 @@ payload assembled from `results/environment_snapshot_build.json`,
 `results/environment_snapshot_run.json`, or
 `results/environment_snapshot_build_run.json`.
 
+## Profile Request Workflow
+
+Execution profile requests are tracked separately from the approved profile
+registry. The applicant-facing page is `/execution-profile-requests/`; it is
+available to authenticated users and records the requester from the active
+session. The admin review page is `/admin/execution-profile-requests`.
+
+The applicant form intentionally asks only for fields the application side can
+reasonably own: application code, system, optional exp/case scope, optional
+activity, optional desired schedule, optional desired repo/ref watch target, and
+an operational note. Allocation project ID, validity, and trigger conversion are
+reviewer responsibilities.
+
+Requests have a `request_type`:
+
+- `new_profile`: creates an approved execution profile after review.
+- `change_profile`: updates an existing linked profile after review.
+- `pause_profile`: disables the linked profile and its trigger definitions.
+- `retire_profile`: marks the linked profile retired and disables its trigger
+  definitions.
+
+Pause and retirement are state transitions, not deletes. The profile and request
+history remain in the site-local DB so operators can audit what happened and
+why. Deleting a profile remains an admin operation outside the applicant request
+workflow.
+
+The applicant page shows each request's linked profile, current profile status,
+enabled state, allocation project ID, and enabled/total trigger counts when a
+profile has been created. Follow-up requests are created from that linked
+profile, so the applicant view and the approved registry stay connected after
+the initial approval.
+
 ## GitLab Pipeline Trigger Configuration
 
 Dry-run payload rendering requires:

result_server/app.py

@@ -133,7 +133,7 @@ def _configure_execution_profiles(app, base_dir):
 
 def _register_portal_blueprints(app, prefix):
     """Register all portal blueprints using the given URL prefix."""
-    from routes.admin import admin_bp
+    from routes.admin import admin_bp, profile_requests_bp
     from routes.auth import auth_bp
     from routes.security_metadata import register_security_metadata_routes
 
@@ -142,6 +142,10 @@ def _register_portal_blueprints(app, prefix):
     app.register_blueprint(results_bp, url_prefix=f"{prefix}/results")
     app.register_blueprint(estimated_bp, url_prefix=f"{prefix}/estimated")
     app.register_blueprint(auth_bp, url_prefix=f"{prefix}/auth")
+    app.register_blueprint(
+        profile_requests_bp,
+        url_prefix=f"{prefix}/execution-profile-requests",
+    )
     app.register_blueprint(admin_bp, url_prefix=f"{prefix}/admin")
 
 

result_server/app_dev.py

@@ -246,10 +246,11 @@ def payload_too_large(_error):
 
     app.register_blueprint(auth_bp, url_prefix="/auth")
 
-    from routes.admin import admin_bp
+    from routes.admin import admin_bp, profile_requests_bp
 
     init_csrf(app, exempt_blueprints=(api_bp,))
 
+    app.register_blueprint(profile_requests_bp)
     app.register_blueprint(admin_bp, url_prefix="/admin")
 
     @app.route("/systemlist")