One-view tokens: local records in linked zones, zone lookup, view list

A token for one view of a linked zone (an ACME token for external)
couldn't add records: a new record was shared and reached the other
view. A new name and type is now local when the user may not change it
in the other views. A zone name in several views resolves to the only
one the user can see, and the error no longer names views they can't.
GET /views lists the views a user sees zones in (name, colour, count;
limited) without views:read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/views.md

@@ -222,7 +222,10 @@ anyway), so scripts don't need to know; `--shared` there is refused.
 a grant for one view only (`views=internal`) can change that view's local
 records and make overrides, but not a shared record, since that would
 change the other views too: Jarl says so and suggests a local record. A
-grant without a view (the usual `zones=adbraun.lol`) covers every view.
+new name and type it adds is local to its view without being asked (an
+ACME token for `views=external` adds its `_acme-challenge` TXT records to
+the external view only). A grant without a view (the usual
+`zones=adbraun.lol`) covers every view.
 
 **Importing a zone file** into a linked zone (`jarl zone import`) adds
 the records like any others: shared, unless the name and type is local