Re the globally installed...
when you do an npm i -g... they will go into /usr/lib/node_modules/...
As this is how Node-RED is installed it will itself be in /usr/lib/node_modules/node-red
and of course it drags in all it's own pre-reqs under itself at /usr/lib/node_modules/node-red/node_modules/...
So.... the other few at the usr/lib/node_modules level are a few extras I include in the Pi image that I think are useful - but aren't in the base - like random, ping and smooth etc.
ALL of these are part of the default package and are installed and can be re-installed or upgraded using the standard sudo apt-get update && sudo apt-get install nodered - assuming you are using the standard base install. (so to my mind shouldn't need to be backed up as a clean install would be better... but that's just me.. and of course if you've added anything else globally then they would be here also).
Re npm
currently version 2.x is still best for Pi (3 does now seem to work but takes about almost twice as long to run) - so again a sudo npm i -g npm@2.x should still get you the latest.
Re .node-red and package.json
you can create this automatically if you install your extra nodes by using npm i --save {node-name}
BUT this will pin the version to the one at install time... if you then try npm update it will only install the version in the package.json. (Which for a backup may well be a good thing).