feat(auth): add local and OIDC management to tht

tools/tht/internal/safeio/private_unix.go

@@ -3,10 +3,21 @@
 package safeio
 
 import (
+	"errors"
 	"os"
 	"path/filepath"
 )
 
+func createPrivateDirectory(path string) error {
+	if err := os.Mkdir(path, 0o700); err != nil {
+		if errors.Is(err, os.ErrExist) {
+			return os.ErrExist
+		}
+		return err
+	}
+	return ProtectPrivateDirectory(path)
+}
+
 // ProtectPrivateDirectory sets the private directory mode used for local authentication state.
 func ProtectPrivateDirectory(path string) error {
 	if err := ValidateCanonicalPath(path); err != nil {