There's both NPM lockfile (`package-lock.json`) and Yarn lockfile (`yarn.lock`) – can we remove the former and standardize to Yarn?