Add .npmignore

Without a .npmignore, the default is to ignore what's in
.gitignore, which includes dist/*.js, which should not
be npm-ignored.