Refactor SQL queries: enforce parameterized bindings and consistent style

[solverat]

Audit and cleanup of all raw SQL queries across the codebase (~840 query sites).

• Replace executeQuery() with executeStatement() for all DML (INSERT/UPDATE/DELETE)
• Eliminate $db->quote() value embedding in favor of ? / :name parameter bindings
• Refactor buildConditionPartsFromDescriptor() to return [$conditions, $params] instead of inlining quoted values
• Replace string concatenation for dynamic table names with sprintf()
• Apply consistent style: single-quoted PHP strings, SQL keywords uppercase, multi-line formatting for long queries, no trailing semicolons

Deprecations

• OpenDxp\Db\Helper::fetchPairs => No replacement
• OpenDxp\Db\Helper::selectAndDeleteWhere => No replacement
• OpenDxp\Db\Helper::quoteInto => Use parameterized queries with ? or :name placeholders instead.

[github-actions]

Review Checklist

• Target branch (1.0 for bug fixes, others 1.x)
• Tests (if it's testable code, there should be a test for it - get help)
• Docs (every functionality needs to be documented, see here)
• Migration incl. install.sql (e.g. if the database schema changes, ...)
• Upgrade notes (deprecations, important information, migration hints, ...)
• Label
• Milestone