Add make add-dependency and make tidy (closes #45)

No entrypoint could change yarn.lock or go.mod: script/bootstrap
installs with --frozen-lockfile, so adding a package meant running
yarn by hand. make add-dependency PACKAGE=<name>@<version> shims to
the new script/add-dependency: yarn add --dev, then yarn install
--frozen-lockfile. make tidy shims to the new script/tidy, go mod
tidy in backend/; a Go module is added by importing it, or moved by
editing its require line, then make tidy. script/bootstrap is
unchanged.

Model: opus-5-5

README.md

@@ -58,6 +58,13 @@ halves, so the root `make check` fails if either one is broken. We provide:
 - `script/fmt` — format all files (writes): prettier, then gofmt over `backend/`
 - `script/fmt-check` — check formatting (read-only): prettier, then gofmt
 - `script/check` — run test, lint, and fmt-check
+- `script/add-dependency` — add a frontend package, or move one to another
+  version: `make add-dependency PACKAGE=<name>@<version>` runs `yarn add --dev`,
+  which changes `package.json` and `yarn.lock` together, then
+  `yarn install --frozen-lockfile`
+- `script/tidy` — run `go mod tidy` in `backend/`: to add a Go module, import it
+  and run `make tidy`; to move one to another version, edit its `require` line
+  in `backend/go.mod`, then run `make tidy`
 - `script/frontend-test` — run the unit tests in `test/unit/` with Node's
   built-in test runner, through the `test` script in `package.json`, and if any
   fails, run them again listing every test, and fail; then the production build.