Roughly it goes like this:
- You have to boot WordPress first. If you boot your app first then it won’t be able to reliably boot WP core. At least in code meant for distribution. This is your main design constraint.
- Since you start with WP core you automatically have access to all the goodies. For things you mentioned these would primarily be all user stuff (dead easy to use) and rewrite for URLs (total hell).
- Once you have the path from URL through users to your app you will need to point that JS front end to talk to WP (still same constraint — it needs to). Good news is WP has Ajax endpoint which is passable to use (fancy REST API planned, but not here yet). Bad news is that it is dead slow and depending on how talkative your app is on Ajax side may become significant performance constraint for it.
- Once you have all this pieced together it shouldn’t be too hard to bolt to WP admin. People have been putting all kinds of crazy custom things in it for a long time (for better and worse).