One-view tokens: local records in linked zones, zone lookup, view list

A token for one view of a linked zone (an ACME token for external)
couldn't add records: a new record was shared and reached the other
view. A new name and type is now local when the user may not change it
in the other views. A zone name in several views resolves to the only
one the user can see, and the error no longer names views they can't.
GET /views lists the views a user sees zones in (name, colour, count;
limited) without views:read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -37,6 +37,19 @@ All notable changes to Jarl are documented here. The format follows
 
 ### Fixed
 
+- A token for one view of a linked zone (such as an ACME token with
+  `views=external`) couldn't add records: a new record is shared, and
+  that reached the other view. A new name and type is now local to the
+  view when the user may not change it in the other views.
+- A zone name in several views had to be given with `--view` even when
+  the user could see it in only one (`jarl record list adbraun.lol` with
+  a one-view token), and the error named views the user can't see. Now
+  the one they can see is used.
+- `jarl view list` was empty for a user without `views:read`, though
+  they can see zones in views. It now lists those views by name, colour
+  and visible zone count (marked `limited` in the API), without their
+  settings.
+
 - The DNSSEC tab told you to give the DS record to your registrar for
   every zone whose parent isn't in Jarl in the same view. Now it (and
   `jarl zone dnssec status`, and the API's new `ds_at`, `ds_place` and