hardening: migrate monitor SQL helpers to prepared variants

[somethingwithproof]

Problem

plugin_monitor still contains selected raw SQL helper usage for plugin version lookup, uninstall cleanup, and monitor-device cleanup paths.

Proposed change

• migrate targeted db_fetch_cell() and db_execute() call sites to prepared helpers in setup.php
• use placeholder-based IN (...) handling for multi-device cleanup
• preserve behavior

Tests

• add standalone regression test asserting targeted statements use prepared helpers
• run syntax checks for touched files