You should consider a Progressive Web Application: requires SSL, and you can place this on the Apple and Google app stores. You just have to do a small and fair amount of JS witchcraft.
To get the most out of a native app, I would want to do client-side encryption/hashing (right now the server sees plaintext for a millisecond, just like most servers treat passwords), and use mobile notifications instead of email, for the communication mechanism. Not saying a PWA wouldn't fit the bill, but unfortunately it's a bit beyond just wrapping it in a WebView and packaging as an app. I suppose as an MVP maybe? Just go get on the stores?
