No, a single certificate cannot be valid for an arbitrary site. This rule applies to self-signed certificates as well as ordinary ones.
Consider the potential consequences if the web browser did allow this: if the user accepted your certificate (because they want to connect to your application) you or anyone else would then be able to use that certificate to impersonate any other site on the planet and your users wouldn't be able to tell the difference.
Your second suggestion of a single self-signed root certificate used to sign the individual certificates dynamically would also result in the same serious security vulnerability. Since the private key for the root certificate would have to be shipped as part of your software, it cannot be considered secure.
(For completeness: there are mitigations such as certificate transparency, and you can configure a browser to accept a particular certificate only for a particular site; that might even be the default, I'm not sure - but I don't think these details significantly change the underlying analysis as they are defence-in-depth measures, not intended to be the only layer of protection.)
Instead, your application should generate a self-signed certificate itself, either at installation time or when the user first connects. This is a common practice for web-based management consoles. You should also give the user the option of providing a correctly signed certificate instead.
If you need assistance implementing this, you should probably ask on Stack Overflow.