Track package.json and package-lock.json for reproducible installs

Previously both were gitignored, requiring npm init + npm install on
every fresh clone. Now only node_modules/ is ignored.

scripts/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "actual-budget-skill",
+  "version": "1.0.0",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@actual-app/api": "^26.3.0"
+  }
+}