psql -d appdb -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO app;"

Sets privileges that apply automatically to tables created later, solving the classic new-tables-are-invisible problem. The default applies to objects created by the current role, so run it as the schema owner.