feat(server): activate projected authentication safely

tools/tht/internal/authconfig/commands_projection_linux.go

@@ -0,0 +1,14 @@
+//go:build linux
+
+package authconfig
+
+import "os"
+
+var authProjectionEffectiveUID = os.Geteuid
+
+func requireProjectedAuthMutationPrivilege() error {
+	if authProjectionEffectiveUID() != 0 {
+		return errCommandRefused
+	}
+	return nil
+}