This app was mentioned in 2 comments, with an average of 5.50 upvotes
Follett is "full stack" in that they have their own wholesaler/distribution arm, college bookstore operators (their biggest business), their own eCommerce site, and have started working on their own digital e-reader. Read their hilariously awful reviews here.
IANAL. I know about this much (holds forefinger and thumb together) about current app development.
This is a great idea, and even if it goes nowhere financially, you're learning valuable stuff. A big thing you're learning at a young age is the political BS you get with any commercial software product; it may be frustrating at times, but it'll come in handy later.
Talking to Follet - excellent idea. They need a mobile app, and maybe that's how you can cash in. (Ffs look at the bad reviews for their existing mobile app at https://play.google.com/store/apps/details?id=com.follett.fsc.Enlight - they need you or somebody like you, to go mobile.)
The more you separate your app from your city or school, the better. Of course your ability to use the Follet app is based on Follet licensing the app to your school, but that dosn't mean the school can tell you what to do/not do - unless they think you're violating the terms and conditions of the software license. So don't tell the school/city anything, leave them out, and focus on Follett.
Security issues can be overcome. You app is like Tinfoil for Facebook, a wrapper. There's infinity resources and forums from which you can learn.
You're not stepping on the city's toes, you're making an app. Why the f is local government developing an app in the first place? I wouldn't meet with them because you have nothing to gain. All they'll do is bitch that you're taking their jobs, or you're not allowed to do that, or whatever.
Why meet with the city IT director? They'll just tell you to Stop Doing That, etc. I absolutely admire that you're Thinking Big and reaching out to the city and to Follett.
The security of your program - assuming you're the only ones using it and you're using your Follett user/password credentials to test and develop - is no big deal at this point, and you'll figure it out.
As for the permission to develop your app, you're talking to Follett directly - and at this point it hardly matters what role your Follett contact has; they work for Follett, they're not saying no, so keep going. They'll yell if you go too far, like if you start selling your app without working out a deal with them. This is the third-party commercialization point you mention. To go commercial you'll need a contract with Follett. I think. IANAL. You'll want a contract so you are supported, and get advance hookup for app changes on their end.
The only development connection you need - that will help you move forward - is with Follett. Not the city or school.
If you don't have one, start making a product map. You have (at least) these development tracks: functionality, security, standards, platforms. Functionally your app should do everything Follett's app does. Security done correctly answers all the questions you raise; step 1 is, user starts app, enters id and password to log in every time; step 2, safely store user credentials so when they start the app, they are logged in, or get logged in invisibly. Standards means when you're developing your app, you want to follow common standards, framework, etc; of course your app depends on Follett's API and ways of doing things, but you'll advance your careers and learn a lot if you develop like other pros develop. I barely know what I'm talking about, but I know enough that weird one-off code is not the way to go. Platforms means eventually doing your app for Android and IOS.
I'm not a lawyer nor much of a developer. Things to think about:
a. You may have removed your school and city from your code, but your github is named/branded Melrose.
b. The github is tied to a class you're taking.
c. The school or city might bitch about who owns your code. This is the IP (intellectual property) question. I think you own the code, just as you would own a term paper you wrote. You don't need to go see a lawyer right now. But in case the school goes nuclear, make a copy of all your product code, and store that on your own computers and your own Google Drive/Dropbox.
d. If you're thinking about working with Follett and going commercial, you may not want your code on github. You do want to control your intellectual property; if Follett doesn't make you rich, you will want to reuse that code down the road.
Zuckerberg didn't ask colleges if he could screen-scrape their facebook websites. Good luck, plow ahead.