docs: add illustration for appying filters on non-filter compliant endpoints

Author: alukach

README.md

@@ -329,7 +329,7 @@ If enabled, filters are applied to the following endpoints:
   - **Applied Filter:** `ITEMS_FILTER`
   - **Strategy:** Validate items in body with generated CQL2 query.
 
-#### Example GET Request Flow
+#### Example Request Flow for multi-record endpoints
 
 ```mermaid
 sequenceDiagram
@@ -341,6 +341,20 @@ sequenceDiagram
     STAC API->>Client: Response
 ```
 
+#### Example Request Flow for single-record endpoints
+
+The Filter Extension does not apply to fetching individual records. As such, we must validate the record _after_ it is returned from the upstream API but _before_ it is returned to the user:
+
+```mermaid
+sequenceDiagram
+    Client->>Proxy: GET /collections/abc123
+    Note over Proxy: EnforceAuth checks credentials
+    Note over Proxy: BuildCql2Filter creates filter
+    Proxy->>STAC API: GET /collection/abc123
+    Note over Proxy: ApplyCql2Filter validates the response
+    STAC API->>Client: Response
+```
+
 #### Authoring Filter Generators
 
 The `ITEMS_FILTER_CLS` configuration option can be used to specify a class that will be used to generate a CQL2 filter for the request. The class must define a `__call__` method that accepts a single argument: a dictionary containing the request context; and returns a valid `cql2-text` expression (as a `str`) or `cql2-json` expression (as a `dict`).