🔒 Security: Binding to 0.0.0.0 with 16 workers and no rate limiting

## Description

In `main.py` line 155-159:
```python
uvicorn.run(
"fastapi-docx.main:app",
host="0.0.0.0",
port=9700,
workers=16,
)
```

Combined issues:
1. **No rate limiting** — any client can spam conversion requests, exhausting CPU/memory (each conversion spawns a Word COM process)
2. **16 workers** is hardcoded — should be configurable and reasonable for the host machine
3. **No authentication** — any network-reachable client can convert files

## Why It Matters

Document conversion is CPU-intensive (spawns Word processes). Without rate limiting, a single malicious client can DoS the service.

## Suggested Fix

```python
from slowapi import Limiter
from slowapi.util import get_remote_address

limiter = Limiter(key_func=get_remote_address)
app.state.limiter = limiter

@app.post("/convert/doc-to-docx")
@limiter.limit("10/minute")
async def convert_doc_to_docx(request: Request, ...):
...
```

Make workers configurable:
```python
workers=int(os.getenv("WORKERS", 4))
```