Revisit query construction

[dogversioning]

In some places (notably the chart data endpoint), we're constructing SQL via string concatenation, which is less than ideal. We should do the following:

• See if there's a pre-existing layer that adds jinja support for lambdas
  • If so, flip to using templates
  • If not, be more careful about quoting parameters

[dogversioning]

addressed via #139