One-view tokens: local records in linked zones, zone lookup, view list

A token for one view of a linked zone (an ACME token for external)
couldn't add records: a new record was shared and reached the other
view. A new name and type is now local when the user may not change it
in the other views. A zone name in several views resolves to the only
one the user can see, and the error no longer names views they can't.
GET /views lists the views a user sees zones in (name, colour, count;
limited) without views:read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/permissions.md

@@ -160,7 +160,14 @@ records:write zones=acme.adbraun.lol types=TXT            only TXT records in a
 ```
 
 A user who may see some records of a zone may also see that the zone exists
-(its name and type), but not its other records.
+(its name and type), but not its other records. They also see the zone's
+view in `jarl view list` (`GET /views`): its name, colour and how many
+zones they can see there, marked `limited`, but not its settings
+(`match-clients` and the rest need `views:read`).
+
+A zone name that is in several views needs a view (`--view`), unless the
+user can see the zone in only one of them: a token for
+`views=external` finds the external copy without being told.
 
 ### Roles