dal: Refactor and update SQL queries

• Hoist SQL strings out of methods.
• Use named parameters rather than positional where possible.
• Fix arguments to get_category_members's SQL that have been incorrect since 197a5721 swapped the sequence of category and hours in the SQL body.