Wordpress and Git - What folders should I track?

It depends on the situation. However, in my view, Git versioning a WordPress site is often more hassle than it's worth. The reason is because tracking the state of the site can not be distilled down to merely the code that sits on your server; it also depends on the contents of the database. Unless you have a scheme to include some kind of database export in with your version control, it's not really a true way of tracking the site's state.

For most of my WordPress installs, I might have one custom developed theme/child theme and one custom developed plugin. These each get version controlled in their own Git repo. I make git commits from my local development environment and push changes to production via SSH, SFTP, or whatever makes sense for this specific server.

For production environment, I setup automated off-site backups of the /wp-content folder and the MySQL database.

This might not be exactly the answer you were looking for. However, in my experience, this has worked best for me in managing countless WordPress sites. I would love it if WordPress sites supported composer packages in a more native way, but ultimately, it's a different kind of animal.

This is subjective and depends on what you are trying to achieve. A theme developer may have a different requirement than a plugin developer. Here is a good gist of a bare minimum .gitignore file for a WordPress install.

# -----------------------------------------------------------------
# .gitignore for WordPress @salcode
# ver 20160309
#
# From the root of your project run
# curl -Ohttps://gist.githubusercontent.com/salcode/b515f520d3f8207ecd04/raw/.gitignore
# to download this file
#
# By default all files are ignored.  You'll need to whitelist
# any mu-plugins, plugins, or themes you want to include in the repo.
#
# ignore everything in the root except the "wp-content" directory.
/*
!wp-content/

# ignore everything in the "wp-content" directory, except:
# mu-plugins, plugins, and themes directories
wp-content/*
!wp-content/mu-plugins/
!wp-content/plugins/
!wp-content/themes/

# ignore all mu-plugins, plugins, and themes
# unless explicitly whitelisted at the end of this file
wp-content/mu-plugins/*
wp-content/plugins/*
wp-content/themes/*

# ignore all files starting with . or ~
.*
~*

# ignore node dependency directories (used by grunt)
node_modules/

# ignore OS generated files
ehthumbs.db
Thumbs.db

# ignore Editor files
*.sublime-project
*.sublime-workspace
*.komodoproject

# ignore log files and databases
*.log
*.sql
*.sqlite

# ignore compiled files
*.com
*.class
*.dll
*.exe
*.o
*.so

# ignore packaged files
*.7z
*.dmg
*.gz
*.iso
*.jar
*.rar
*.tar
*.zip

# -------------------------
# BEGIN Whitelisted Files
# -------------------------

# track these files, if they exist
!.gitignore
!.editorconfig
!README.md
!CHANGELOG.md
!composer.json

# track these mu-plugins, plugins, and themes
# add your own entries here
!wp-content/mu-plugins/example-mu-plugin/
!wp-content/plugins/example-plugin/
!wp-content/themes/example-theme/

Basically ignore everything except your theme folder and custom plugins. sample .gitignore:

wp-admin/
wp-includes/
.htaccess
index.php
license.txt
liesmich.html
readme.html
wp-activate.php
wp-blog-header.php
wp-comments-post.php
wp-config.php
wp-config-sample.php
wp-config-stage.php
wp-config-live.php
wp-config-dev.php
wp-config-production.php
wp-cron.php
wp-links-opml.php
wp-load.php
wp-login.php
wp-mail.php
wp-settings.php
wp-signup.php
wp-trackback.php
xmlrpc.php
config/
wp-content/plugins/
wp-content/mu-plugins/
wp-content/languages/
wp-content/uploads/
wp-content/upgrade/
wp-content/themes/*

# don't ignore the theme you're using
!wp-content/themes/yourthemename

This makes the most sense when used together with composer for installing wordpress and plugins.