feat(server): activate projected authentication safely

tools/tht/internal/backup/restore_projection_linux.go

@@ -0,0 +1,17 @@
+//go:build linux
+
+package backup
+
+import (
+	"errors"
+	"os"
+)
+
+var restoreProjectionEffectiveUID = os.Geteuid
+
+func requireAuthProjectionRestorePrivilege() error {
+	if restoreProjectionEffectiveUID() != 0 {
+		return errors.New("projected authentication restore requires root")
+	}
+	return nil
+}