Linked zones: shared records kept in step across views

Zones of the same name in different views can be linked. Shared records
are kept in step: a change in one view reaches the others in the same
changeset, as explicit operations, so the diff, permission checks,
history and undo cover every view. Records local to a view override the
shared records of that name and type there; removing the override brings
the shared ones back, and sharing a view's version makes it every view's.
Each zone keeps its own options, serial and file.

Linking existing zones changes no answer: what is the same everywhere
becomes shared, the rest stays local. Unlinking keeps every record, all
local. ACME challenges are written once per link, and --view all changes
a link once. jarl zone link/unlink, zone create --link-with, record
--local/--shared, LINK column, web UI controls, POST /zones/{zone}/link
and /unlink, validation checks linked_*, store migration 11, docs and
e2e.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/h_acme.go

@@ -158,7 +158,7 @@ func primaryZonesFor(st *model.State, p *auth.Principal) []acme.Zone {
 	for _, z := range st.SortedZones() {
 		vn := st.ViewName(z)
 		if z.Type == model.ZonePrimary && !z.Disabled && p.CanSeeZone(z.Name, vn) {
-			out = append(out, acme.Zone{Name: z.Name, View: vn})
+			out = append(out, acme.Zone{Name: z.Name, View: vn, Link: z.LinkGroup})
 		}
 	}
 	return out