app: fix a bunch of valgrind-found leaks