docs: explain ballot multiplicity in offline audits

[nealmcb]

Summary

Adds docs/offline-audits.md, explaining ballot multiplicity for jurisdictions running offline ballot-polling audits.

Ballot-polling samples are drawn with replacement, so a physical ballot can be drawn more than once in a round. Today:

• The retrieval list only hints at this via comma-joined ticket numbers in the "Ticket Numbers" column — no explicit multiplicity count.
• The "Ballots to audit" figure shown to jurisdiction admins is the count of unique physical ballots, not the weighted sample size (draw count) used to validate offline results.
• Offline-results validation only checks an upper bound on entered totals, so an admin who tallies against the unique-ballot figure and forgets to double-count a repeated ballot will silently undercount — no error is raised.

There's currently no documentation anywhere explaining this. This doc is a stopgap while the underlying product gap (a real multiplicity column on the retrieval list, and/or surfacing the weighted sample size in the UI) is tracked in #779.

Test plan

• Docs-only change, no code paths affected