api/app: lock app for changes during operations with side-effects

This is not ideal yet.

Right now there's a middleware responsible for locking and unlocking the
app during the request. However, some requests start goroutines that are
responsible for changes on the app.

Ideally each handler should be responsible for releasing the lock on the
app on the appropriate time. This will be implemented in future commits.