I'm an enjoyer of anonymity online and would rather not doxx myself. However if you have a specific question, I'd be happy to answer. I use js/jq for the front-end and php for the backend. Once you have your own CMS, turning it into a SPA means turning your index.php into a index.html that is php free and relies on ajax calls to change the content. So at minimum you need a mainbody.php and a head.php that accept inputs. After that it's just onclick actions on buttons that trigger the ajax function changeMainbody(targetPage). Or changeHead() after a user loggs in. On the phone app side you use the regular WebView, to avoid any cross-origin blocks and problems. Alternatively you can run it locally and pass the cookies as inputs - depending on the app needs. Should be safe using https, right? I fully expect to be scolded by someone with 20years more experience, but I guess that's how you learn.

Of course there's more to it, depending on the app needs. In my case it also auto refreshes the contents on a js timer.

What UX regressions did you have in mind as troubling? Things like resetting one's password if forgotten? Well all those things need to be turned into their own ajax calls and php scripts as well and sometimes reworked to fit mobile users needs. For resetting passwords specifically I just copied what Twitch.com does.