One-view tokens: local records in linked zones, zone lookup, view list

A token for one view of a linked zone (an ACME token for external)
couldn't add records: a new record was shared and reached the other
view. A new name and type is now local when the user may not change it
in the other views. A zone name in several views resolves to the only
one the user can see, and the error no longer names views they can't.
GET /views lists the views a user sees zones in (name, colour, count;
limited) without views:read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/acme.md

@@ -48,7 +48,9 @@ jarl acme unset DOMAIN [VALUE...]   # remove these values, or all of them
 * The zone is found automatically: the longest matching primary zone.
 * If the zone exists in several **views** (split DNS), the record is written
   into every view, so the CA (on the internet, in your external view) and
-  your internal resolvers see the same thing. `--view NAME` limits it to one.
+  your internal resolvers see the same thing. `--view NAME` limits it to one,
+  and so does a token for one view (`views=external`): in a linked zone its
+  records are then local to that view.
 * All values and views go into one changeset. Setting a value that is
   already there succeeds, so a retried hook doesn't fail, and removing a
   value that isn't there succeeds as well.