🔒 Security: Wildcard CORS policy allows any origin

## Description

In `main.py` lines 21-25, CORS is configured with:
```python
app.add_middleware(
CORSMiddleware,
allow_origins=["*"],
allow_methods=["*"],
allow_headers=["*"],
)
```

This allows **any website** to make requests to the API, which could be exploited for:
- Unauthorized file conversion abuse (resource exhaustion)
- CSRF-like attacks if authentication is ever added

## Why It Matters

Even for an internal tool, wildcard CORS is a bad default. If deployed publicly, anyone can use your server as a free document conversion service.

## Suggested Fix

Restrict to known origins via environment variable:
```python
import os
origins = os.getenv("CORS_ORIGINS", "http://localhost:3000").split(",")
app.add_middleware(
CORSMiddleware,
allow_origins=origins,
allow_methods=["POST", "GET"],
allow_headers=["*"],
)
```