Design the off-chain voting module

## Outcome

A reviewed product, security, and technical design defines trustworthy off-chain voting.

## Scope

- Define eligibility, identity, ballot, tally, privacy, and audit requirements
- Threat-model manipulation, replay, sybil, moderation, and availability risks
- Define data model, API boundaries, and result-verification approach
- Produce UX flows and a phased implementation plan

## Acceptance criteria

- [ ] Scope is decomposed into independently deliverable child issues.
- [ ] Architecture and API decisions are linked from this issue.
- [ ] Test, documentation, observability, rollout, and failure behavior are defined where applicable.
- [ ] Epic exit criteria are verified before closure.

## Planning note

This is a 2026 GovTool revamp work item. Its child features and tasks should be added as the scope is refined.

No files, tests, or entry points are named. Start by decomposing the eligibility, identity, ballot, tally, privacy, audit, threat-model, API, UX, and rollout scope into child issues; done means linked architecture and API decisions plus defined testing, documentation, observability, rollout, and failure behavior.

Written by the indexing model from the issue text.