docs: clarify account provisioning requirement for first-time CLI auth

docs/install/CALL-E-installation-guide.md

@@ -59,6 +59,16 @@ After the user confirms authorization is complete, finish the pending login:
 env CALLE_SOURCE=skills_sh CALLE_INTEGRATION=skills_sh_skill CALLE_INTEGRATION_VERSION=0.1.0 calle auth login --no-browser-open
 ```
 
+## Step 3.5 First-Time Users: Create The Account
+
+<!-- sync-with: docs/install/install-guide.md#authentication-and-verification -->
+
+`calle auth login` uses the same flow for new and existing accounts: it opens
+the brokered dashboard sign-in, where **Continue with Google** registers a new
+account or signs in an existing one, then returns you to the same session to
+finish. Full first-time-user detail: install-guide.md →
+[First-Time Users](./install-guide.md#first-time-users-create-the-account).
+
 ## Step 4 Verify
 
 ```bash

docs/install/cli.md

@@ -28,6 +28,10 @@ The command opens the brokered login URL, polls until authorization completes,
 exchanges the authorized session, and stores the token in a private local cache.
 The token is never printed to stdout.
 
+First time? On the sign-in page choose **Continue with Google** to register a
+new account and return to the same session; details in
+[install-guide.md](./install-guide.md#first-time-users-create-the-account).
+
 For agent integrations that need to show the authorization link before
 continuing:
 

docs/install/install-guide.md

@@ -186,6 +186,20 @@ The Codex, Claude Code, Cursor plugin, OpenClaw, and skills.sh skills use the
 repository-local CLI when available, then a global `calle`, then the
 npm fallback.
 
+### First-Time Users: Create The Account
+
+`calle auth login` uses the same flow for new and existing accounts:
+
+1. `calle auth login` opens the brokered dashboard sign-in.
+2. On the sign-in page choose **Continue with Google**. For a new Google
+   identity this registers the account; for an existing account it signs in.
+3. The dashboard shows that it is preparing your workspace, then returns you
+   to the same sign-in session so `calle auth login` can finish.
+
+The Google sign-in route and the preserved broker session are confirmed on
+the deployed dashboard. If any step fails, see
+[Troubleshooting](./troubleshooting.md).
+
 ## Safety
 
 CALL-E can place real outbound phone calls. Integrations must plan first,