One-view tokens: local records in linked zones, zone lookup, view list

A token for one view of a linked zone (an ACME token for external)
couldn't add records: a new record was shared and reached the other
view. A new name and type is now local when the user may not change it
in the other views. A zone name in several views resolves to the only
one the user can see, and the error no longer names views they can't.
GET /views lists the views a user sees zones in (name, colour, count;
limited) without views:read.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/expand.go

@@ -76,11 +76,13 @@ func (x *expander) resolveZone(zoneID int64, zone, view string) (*model.Zone, er
 	if zone == "" {
 		return nil, errf(KindBadRequest, "the zone is missing (zone_id or zone)")
 	}
-	return FindZoneRef(x.st, zone, view)
+	return FindZoneRef(x.st, zone, view, func(z *model.Zone) bool { return x.p.CanSeeZone(z.Name, x.st.ViewName(z)) })
 }
 
-// FindZoneRef finds a zone by name and optional view name.
-func FindZoneRef(st *model.State, zone, view string) (*model.Zone, error) {
+// FindZoneRef finds a zone by name and optional view name. Without a
+// view, a name in several views needs one, counting only the zones sees
+// allows (nil: all): a token for one view finds that view's zone.
+func FindZoneRef(st *model.State, zone, view string, sees func(*model.Zone) bool) (*model.Zone, error) {
 	name, err := ParseZoneName(zone)
 	if err != nil {
 		return nil, errf(KindBadRequest, "%v", err)
@@ -97,6 +99,16 @@ func FindZoneRef(st *model.State, zone, view string) (*model.Zone, error) {
 		return z, nil
 	}
 	zs := st.ZonesNamed(name)
+	if sees != nil && len(zs) > 1 {
+		var vis []*model.Zone
+		for _, z := range zs {
+			if sees(z) {
+				vis = append(vis, z)
+			}
+		}
+		zs = vis // none: not found, without naming the views
+	}
+	st.SortByView(zs)
 	switch len(zs) {
 	case 0:
 		return nil, errf(KindNotFound, "zone %s does not exist", dnsname.Display(name))