move node_modules out of the repo, add package.json to track deps