As this is greenfield work I'd like us to prioritize adding tests alongside any new functionality. While the code looks correct (-ish, since we do sync I/O from an async function), I would like to see tests. Ideally the tests do not require filesystem interactions either, which requires a design update.

Ideally I'd picture LocalSecretsStorage to be a generic type that holds some type of handle we could read and write to. In production this would be an tokio::fs::File object for the secrets.json file. but in tests a plain Vec should do.

Thank you for bearing with me. Just some nits but otherwise looks great. Ideally we'd use dedicated error types but I'm okay with skipping that for now.

Nice stuff!