I wouldn’t try and do any of that in app.yml; that only gets run at container rebuild time, and there’s no need to trigger a rebuild in order to add another site to a multisite config. I’d strongly recommend going down the custom plugin route to apply config settings, unless your single-forum-with-category-restrictions approach is working for you (which is even easier).