How to manually run/init/start a Xorg server on a different VT/TTY?

Do not use xinit, because it is vulnerable. Use startx. xinit appears to be written to accept X connections from any user ID, without warning or documentation. startx appears to fix this. I do not know why this situation is tolerated, or how it happened in the first place.

The way X works has changed "recently". X used to rely on being set-uid root, and switch to a new VT. Note, even then, X might only have worked if you started it from a text VT. E.g. a non-root user might not be able to start X from inside another X session. In other words, I'm not sure whether this would do what you want anyway.

X has now been changed so that it can use the current VT instead. Some tools such as startx have changed their behaviour, to use the new design.

The design is you do not need to start any program as root (in order to improve security). This works by using logind instead, a smaller background service (which is started with root privileges).

If you went back to running X as root, you would not need permission from logind. I think X will probably remain compatible with this.

You appear to have been trying to run X without forcing it to run as full root. In that case you need permission from logind. logind gives you permission to do stuff on the VT you logged in on. I worked out a trick to spoof a login.

user=mahr
sudo systemd-run \
    --property PAMName=login \
    --property User="$user" \
    --property StandardInput=tty \
    --property TTYPath=/dev/tty8 \
    sh -c 'chvt 8 && exec startx /usr/bin/xterm'

It feels like it should be possible to allocate the tty dynamically as well (using openvt -s, and a script using the tty command). However, I have just frozen my screen a couple of times trying to do that :-).

(logind intended to reduce how much damage non-root programs like this X server can do to the system. AIUI the implementation of this is quite limited. It does not provide a recovery key. logind even gets killed horribly if you use the kernel System Attention Key.)

Even after using the kernel command SysRQ + R, I could not recover the screen. I think something broke, probably logind or gdm :-).

by my test, your commands will work well if you put this 2 lines in /etc/X11/Xwrapper.config :

allowed_users=anybody
needs_root_rights=yes

it seems that X server starting is by default allowed only to user that is the owner of target virtual terminal and physically (keyboard) connected to it. (your case: root is vt-owner, and x tried to run as 'mahr').

This two lines overrides that request, and makes even possible starting all from one command, one terminal (useful for init scripts or remote x starting with ssh).

sudo openvt -c15 -- su user -c 'xinit /usr/bin/xterm -display :15 -- :15 vt15'

Here is my version of @sourcejedi's answer (sorry, it wouldn't go in a comment):

#!/bin/sh                     
# login-spoof

# Pretend that we're running a command after having logged into a
# given virtual terminal as us. Example:

# $ ./login-spoof 8 startx /usr/bin/xterm -- :1
# Running as unit: run-r3cc564bee3134c789c09c21faee9e710.service
# (opens xterm on /dev/tty8)

TTYNUM=$1; shift
sudo systemd-run \
    --property PAMName=login \
    --property User="$USER" \
    --property StandardInput=tty \
    --property TTYPath=/dev/tty$TTYNUM \
    sh -c 'export PATH="'$PATH'"; chvt '$TTYNUM' && exec "$@"' x "$@"