Backend npm tarball hygiene #296

Part of #277

packages/backend has no files field and no .npmignore, and the
root .npmignore does not apply to workspace packages, so the published tarball
ships src/ and tests/. Now that npx @wdio/devtools-backend is a supported
entry point, the tarball is user-facing.

Acceptance criteria

The tarball contains dist and the README only, with
npm pack --dry-run output reviewed in the PR.