chore: gitignore output/ and tmp/ demo-PDF artifacts

Both are generated by scripts/build_demo_pdf.py — output/ holds the
rendered demo.pdf, tmp/ the intermediate page PNGs it rasterizes on the
way there (~2 MB of them).

Same category as the existing dist-* entries, so grouped with them.

scripts/build_demo_pdf.py itself is deliberately left untracked rather
than ignored — it is source, not output, and whether it belongs in the
repo is a separate call.

Co-Authored-By: Claude Opus 5 <[email protected]>

.gitignore

@@ -4,6 +4,11 @@ dist-showcase/
 dist-demo/
 *.log
 .DS_Store
+
+# Generated by scripts/build_demo_pdf.py — the rendered demo PDF and the
+# intermediate page PNGs it rasterizes on the way there (~2 MB).
+output/
+tmp/
 # impeccable-ignore-start
 .impeccable/config.local.json
 .impeccable/hook.cache.json
@@ -14,3 +19,10 @@ dist-demo/
 
 # tsup temp (mount cannot unlink)
 tsup.config.bundled_*.mjs
+
+# A real .npmrc carries the Gitea registry _authToken — never commit it.
+# This pattern matches the exact filename only, so .npmrc.example (which is
+# meant to be committed) is unaffected.
+# Publishing from a clone: prefer `npm publish --userconfig <path outside the
+# repo>` over writing a token into the working tree at all.
+.npmrc