Add make add-dependency and make tidy (closes #45)

No entrypoint could change yarn.lock or go.mod: script/bootstrap
installs with --frozen-lockfile, so adding a package meant running
yarn by hand. make add-dependency PACKAGE=<name>@<version> shims to
the new script/add-dependency: yarn add --dev, then yarn install
--frozen-lockfile. make tidy shims to the new script/tidy, go mod
tidy in backend/; a Go module is added by importing it, or moved by
editing its require line, then make tidy. script/bootstrap is
unchanged.

Model: opus-5-5

TODO.md

@@ -23,6 +23,14 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-10-04: a dependency can be added without running yarn or go by hand
+  (issue #45): `make add-dependency PACKAGE=<name>@<version>` shims to the new
+  `script/add-dependency`, which runs `yarn add --dev`, so `package.json` and
+  `yarn.lock` change together, then `yarn install --frozen-lockfile`; the same
+  command moves a package to another version. `make tidy` shims to the new
+  `script/tidy`, which runs `go mod tidy` in `backend/`: a Go module is added by
+  importing it, or moved by editing its `require` line, then `make tidy`.
+  `script/bootstrap` still installs with `--frozen-lockfile`
 - 2026-10-04: `script/` and `Makefile` follow the org models (issue #28):
   `make dev` shims to the new `script/dev`, the Vite dev server, and the new
   `make build` to `script/build`, the frontend production build.