To add to the other comments, CVV2 / CVC2 is not required for recurring / account-on-file transactions. The first transaction made with the merchant generally does need the CVC2 or in the EU secure customer authentication. For subsequent transactions there is a special flag on the transaction that is for account on file and the issuer will authorise and pay without CVV2.
Some larger merchants will also 'trade' the PAN for an EMV token provided by the card issuer (usually Mastercard or Visa on behalf of the issuer) and then will store just the EMV token which can also be used for recurring payments without the CVV2 and has the advantage that it doesn't need to be protected by the PCI DSS requirements.
To answer your second question, you can't store PAN and CVV2 in a consumer application - although the consumer device is not in your PCI DSS scope, your app is, and so you would be breaking the "don't store sensitive authentication data after auth" rule. It's also not a great way of doing it. If you are going straight from your app to the acquirer for auth (ie bypassing your own servers) the it is better for your app to request a token from the acquirer and then store the token in the keystore as previous commenters have alluded to. Otherwise store the token in your server environment and match it up to the app user.