If I understand correct you want inject React app into the DNN page. And this React app should read DNN context, and in particular who is logged in and what permissions has that user. I'm right ?

Yes, exactly.  Is this possible?
The DNN permission and authentication system is nice and already established.  
Now I want to be able to serve a React web app to authenticated users with permission.  The app pulls data from a separate database.

The simplest way is to create standard DNN module (plugin) that will have React code inside it. This will give full access to the DNN context for the JavaScript (in your case React library) that is inside that module. The React code can call server side DNN method, that can be decorated by:
[DnnModuleAuthorize(AccessLevel = SecurityAccessLevel.Anonymous)]
[AllowAnonymous]
[HttpGet]
etc...

There are downsides of that solution, because if you already have React apps that lives outside of the DNN environment. They must be rewritten and implemented into DNN module.
 

correct - I already have a react app and my developer doesn't know anything about Dotnetnuke. 
I also don't know enough about module development to suggest rewriting it as a module...

Are there other solutions?

You can save DNN info into the cookie, for example in format "user={userID}&dnnPortal={portalID}". Then React app can read that cookie. The biggest drawback can be security in this case. And this will work if both apps (DNN and React) are in the same domain.
More complicated and secured approach is to use protocols like OAuth 2.0 and OpenID Connect.

Thanks -- are there DNN developers available to hire for the more secure authentication approach?

How much would such an approach be expected to cost?

This is above my head and i don't know how complicated it is!