Your PCRE is not right. You might interpret it in more ‘natural’
language
as:
/api/app/<anything but ‘/’>/<anything but ‘/’>/<anything but ‘/’
or
nothing>
The URI /api/app/login does not match it.
You have several ways of addressing that:
Rewrite you huge, do-it-all PCRE, adding optional, non-capturing
groups
Split the rewriting rule in several versions, each addressing one
depth
level (eases readibility/maintenance/performance?)
I would also suggest you avoid using rewrite and replace it with
location/return as much as you could: https://youtu.be/YWRYbLKsS0I