Possibly something along the lines of a chrooted user for $app that all users log into? Said user would run the application program instead of a shell probably,

Possibly something along the lines of a chrooted user for $app that all users log into? Said user would run the application program instead of a shell probably, and actual auth for end users would be more like an http auth style setup instead of "logging in" to the server. At that point I think you're about as safe as "Generic PHP Web App" - I'm sure I've missed something, but that's where I'd start looking.