Linked zones: shared records kept in step across views

Zones of the same name in different views can be linked. Shared records
are kept in step: a change in one view reaches the others in the same
changeset, as explicit operations, so the diff, permission checks,
history and undo cover every view. Records local to a view override the
shared records of that name and type there; removing the override brings
the shared ones back, and sharing a view's version makes it every view's.
Each zone keeps its own options, serial and file.

Linking existing zones changes no answer: what is the same everywhere
becomes shared, the rest stays local. Unlinking keeps every record, all
local. ACME challenges are written once per link, and --view all changes
a link once. jarl zone link/unlink, zone create --link-with, record
--local/--shared, LINK column, web UI controls, POST /zones/{zone}/link
and /unlink, validation checks linked_*, store migration 11, docs and
e2e.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/validation.md

@@ -104,6 +104,20 @@ applied.
 | `dnssec_old_keys` | info | Signing a zone whose key directory still has old keys |
 | `serial_not_higher` | error | An explicit serial on a signed zone must be above the one named has loaded (automatic serials are raised by themselves) |
 
+## Linked zones
+
+See [views.md](views.md#linked-zones). Jarl keeps linked zones in step
+itself, so these only show when something got past it (a change staged
+before the zones were linked, or the database edited by hand).
+
+| Code | Severity | Check |
+|------|----------|-------|
+| `linked_zone_type` | error | Only primary zones can be linked |
+| `linked_zone_name` | error | Linked zones have the same name |
+| `linked_mixed` | error | A name and type in a zone is either shared or local, not both |
+| `linked_out_of_sync` | error | Every view that doesn't override a shared name and type has the same records for it. Link the zones again (`jarl zone link`) to work out what is shared |
+| `linked_zone_alone` | info | A zone linked with no other zone |
+
 ## Blocking
 
 From [blocking.md](blocking.md).