Hi,
First of all, RESTfull service does not cover entire api exposed by jBPM. It does cover the most frequently used operations (starting, signaling, task management, job execution, deployments, etc).
I would say that it depends on the load for that processes and obviously quantity of process instances. If you have millions of executions per day and process a good idea would be to separate them.
Otherwise I think a good option is to have centralized process repository with administration capabilities.
Next I would build the application business logic as set of services/api accessible from jBPM processes. It is something like your point 3 but I would secure that both jBPM and application login is executed within same transaction boundaries by using JTA to keep atomic operations for both parties.
Just to feel safe, is there any special precaution if I use several applications with jbpm hibernate configs that point to the same jbpm database? I assume database wouldn't be of any issue, as transactions are correctly maintained amongst different connections, from different applications. My question resides more on any precaution on the jbpm api side, any special one?
Here I would say that problems can occour when working with job executors. Besides it is hibernate so it could bring regular problems as with any other application accessing the same data base from different places.
That's just me personal opinion. I am open for discussion.
HTH
Maciej