Add make add-dependency and make tidy (closes #45)

No entrypoint could change yarn.lock or go.mod: script/bootstrap
installs with --frozen-lockfile, so adding a package meant running
yarn by hand. make add-dependency PACKAGE=<name>@<version> shims to
the new script/add-dependency: yarn add --dev, then yarn install
--frozen-lockfile. make tidy shims to the new script/tidy, go mod
tidy in backend/; a Go module is added by importing it, or moved by
editing its require line, then make tidy. script/bootstrap is
unchanged.

Model: opus-5-5

Makefile

@@ -1,5 +1,5 @@
 .PHONY: bootstrap setup dev build test lint fmt fmt-check check \
-	frontend-check frontend-viewport-test docker hooks
+	add-dependency tidy frontend-check frontend-viewport-test docker hooks
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -34,6 +34,14 @@ fmt-check:
 check:
 	@script/check
 
+# make add-dependency PACKAGE=<name>@<version>. PACKAGE reaches the
+# script through the environment, so the shell never reads it as code.
+add-dependency:
+	@script/add-dependency "$$PACKAGE"
+
+tidy:
+	@script/tidy
+
 # The frontend tests and format check, for Dockerfile's frontend stage,
 # which has neither Go nor Docker. Use check everywhere else.
 frontend-check: