Lock down frontend dependencies w/npm shrinkwrap

Analog to `Gemfile.lock`. See https://docs.npmjs.com/cli/shrinkwrap