if we take out the recognition of the OSCP, can it be assumed I can table that cert for some other time so I can focus on the above goal?
Honestly, OSCP isn't a huge win for web-app and app-sec in general. OSCP is a network penetration testing cert, is there an overlap with web-app-sec sure, but OSCP atleast where I have worked (appsec, included web but not only) really wasn't really worth much.
That said, OSWE, is a newer cert (atleast online) is web focused. And while I'm a bit mixed on the value of the content (there are better free resources) as a certification I really like it. I think its more relevant to app-sec and web-app stuff than OSCP.
With that being said, I'm looking to go after the eLearnSecurity (eJPT, eWPT, eWPTX) / PentesterLab track as they seem to focus solely on that area.
So, I'm going to mostly avoid commenting on eLS and PL because I don't have hands on experience with them.
Instead I will say the most important thing is having the skill to do the job. One really nice thing about this side of the industry is that while there are a ton smaller, boutique firms doing testing that will give anyone a chance to interview if they can show some minimal competence. Usually involves doing a challenge or two first before they interview but a lot of solid companies do not actually expect formal qualifications (even if they list them). They'll just give you a challenge before hand.
As such, imho worry about your skill first not certs, and for that there are a couple cheaer resources you can reference.
Web Application Hackers Handbook - Its the usual recommendation for web security. Its age is showing, but its good. I know atleast one company that actually gives the book for free to potential candidates.
Portswigger Academy - Instead of updating the above book, Portswigger released the Academy which is free lab-based training. They update the Academy on occasion so its more up to date, covers most of the main web-issues you're going to run into.
Once you've gone through the above, CTF are one way to get practice in, but one of the best things you can do is find a handful of CVEs yourself. And I'd encourage you to try sooner rather than later, its totally normal to need to do research while working, you don't need to know it all upfront.
I'd rather see CVEs on a resume than certifications. A CVE generally means that you found a real vulnerability in a real application, which is exactly what the job requires.
Other than that, having some security related projects looks good too. Automating some stage of an assessment, some technique or whatever. Even if its not new, just adding your own take.