auth: only use yarn in package.json

npm has started to complain that yarn uses a different node binary,
so just use yarn everywhere.