npm dependencies at bundle time

- package.js now has a top-level 'Npm.depends' directive
- both bundle-time and server run-time code can get access
  to any dependent npm module with 'Npm.require'