Well, I tried grepping package.json for suspects 
I feel like you are on the right track, but reading through resolve-url-loader and the reasoning behind it suggests that what I’m trying to do really is a bad idea. Or at least, not worth the trouble. Btw, removing the resolve-url loader (unexpectedly) had no effect on my url()s.
And thank you on the general webpack info, coming from gulp and grunt I can see my fallacy now.