Answer
The fix, despite the error pointing at IFSAPP, is actually on the IFSConnect side: grant the ManageMobileApplication entity/projection action to a permission set that IFSConnect inherits (for example by adding it to the IFS_ALL or a similarly broad permission set already in IFSConnect's grant structure), then refresh the security cache. IFSConnect needs this specific grant to process ManageMobileApplication-related messages, and its absence produces a repeating failure that misleadingly names IFSAPP in the error text rather than clearly pointing at the real gap in IFSConnect's own permissions.