chore: keep dev-only and local files out of the npm package

npm ignores .gitignore as soon as a .npmignore exists, so .claude/settings.local.json, .nvmrc and eslint.config.mjs ended up in the published tarball. I now list them in .npmignore. I also mirror the local and secret patterns from .gitignore (.claude, .vscode, .idea, .env*, *.pem, *.key), because npm never reads them from there.