Fix missing application IDs in the roster

This was caused by a combination of too-strict "created at" checking, combined
with an undefined-ordering problem when joining applications and their
corresponding templates. By explicitly ordering the template table, we can join
applications with more recent templates.

This requires use of a D2 native query.