lml/ost#341: Remove hardcoded SQL.

I owe @Dantemss several beers and my sanity.

- Separate scopes for visible and by_student.
- Use fully qualified objects to avoid duplicate joins.
- Remove hardcoded query.