M1: make mount/unmount idempotent

mount now detects already-unlocked and already-mounted devices, returning
the existing mount point instead of failing. unmount handles already-locked
devices gracefully and skips unmount if not mounted before locking.

Adds IsMounted helper to udisks client. Updates PLAN.md with refined
v1.0.0 milestones.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/mount.go

@@ -40,6 +40,18 @@ func runMount(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
+	// Check if already unlocked.
+	if cleartext, err := client.CleartextDevice(dev); err == nil {
+		// Already unlocked — check if mounted too.
+		if mp, mounted := client.IsMounted(cleartext); mounted {
+			fmt.Println(mp)
+			return nil
+		}
+		// Unlocked but not mounted — just mount it.
+		return doMount(client, cleartext, devCfg)
+	}
+
+	// Need to unlock.
 	u := unlock.New(client, unlock.Options{
 		ReadPassphrase: readPassphrase,
 		KeyfilePath:    devCfg.Keyfile,
@@ -50,16 +62,23 @@ func runMount(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	var mountpoint string
 	if result.Privileged {
-		mountpoint, err = cryptsetup.Mount(result.Device.DevicePath, devCfg.Mountpoint)
-	} else {
-		mountpoint, err = client.Mount(result.Device)
+		mountpoint, err := cryptsetup.Mount(result.Device.DevicePath, devCfg.Mountpoint)
+		if err != nil {
+			return fmt.Errorf("mounting: %w", err)
+		}
+		fmt.Println(mountpoint)
+		return nil
 	}
+
+	return doMount(client, result.Device, devCfg)
+}
+
+func doMount(client *udisks.Client, cleartext *udisks.BlockDevice, devCfg config.ResolvedDevice) error {
+	mountpoint, err := client.Mount(cleartext)
 	if err != nil {
 		return fmt.Errorf("mounting: %w", err)
 	}
-
 	fmt.Println(mountpoint)
 	return nil
 }