add an .npmignore file to counteract .gitignore magic