Add NONCE_AND_SHARES.md — nonce distribution + share math + audit

Section-by-section technical doc anyone can use to audit the pool
back to first principles:

  Part 1 — nonce distribution
    - the 80-byte block header + which fields vary during search
    - the extranonce split (en1 pool-assigned, en2 miner-controlled)
    - the exact atomic + XOR-time algorithm the C proxy uses to
      allocate en1 (with src/stratum.c:688 citation), and why that
      guarantees no two connections search the same triple
    - version-rolling mask and how validation reconstructs exactly
      what the miner claimed
    - multi-rig same-address handling via rig labels

  Part 2 — share calculation
    - header reassembly from cb1/cb2 + en1/en2 + branches
    - worker target vs network target, both checks
    - the validation flow through stratum.c on submit
    - vardiff mechanics + config tunables
    - worked example computing worker difficulty from a real
      target snapshot off the live pool, plus a hashrate sanity
      check from observed share rate

  Part 3 — payout math
    - the FLOOR(difficulty × pps_sats_per_diff) formula
    - per-share truncation vs sum-then-truncate
    - the pps_credits invariants
    - the at-most-once payout protocol summary

  Part 4 — auditing
    - reproducing accrued_sats from raw shares alone
    - the admin cross-check on /admin/worker/:id
    - reconciling with the enforcer Ctip via the deposits table
    - a SQL cookbook: 'how much am I owed', 'who found the last
      block', 'rejects grouped by reason', 'every deposit ever'
    - common mismatches table (⚠ badge, hand-edited pps_credits,
      dashboard hashrate < miner's local display, etc.)
    - explicit list of what the pool CANNOT audit and why (miner
      actual delivery, Thunder-side crediting, operator honesty)

No sensitive info. Every citation is a file:line or a table name.

Author: rsantacroce