why should I have to declare the login/logout methods in App.pm? My logic told me that defining them in sub setup

Declaring methods in the setup() only says what run-modes/methods can be executed. It does not say where those methods are, since you are putting them into the Account package but you are attempting to use them as a method in the App package the program cannot find them.

By using 'base' you are saying, all the methods that are a part of the Account class, make them a part of the App class as well. So the program runs it will check App class first for a login() method, it cannot find it. It checks the Account class for a login() method, finds and then runs it, all is well! :)

Does this mean that if I create more custom modules to package related functionality together, I would have to do the use base

basically, yes. It is not easy to grasp at first, I know because I struggled with it too. Try it a couple of time and eventually you will get around to figuring it out.