🔒 Security: Wildcard CORS, binding 0.0.0.0, and exception detail leakage

## Description

Several security concerns in the current configuration:

### 1. Wildcard CORS — `main.py` line 22-25
```python
app.add_middleware(
CORSMiddleware,
allow_origins=["*"],
allow_methods=["*"],
allow_headers=["*"],
)
```
Allows any website to make requests to this service. If deployed on a network, any malicious page could trigger document conversions.

### 2. Binding to 0.0.0.0 — `main.py` line 133
```python
uvicorn.run("fastapi-docx.main:app", host="0.0.0.0", port=9700, workers=16)
```
Exposes the service on all network interfaces by default.

### 3. Exception details in HTTP response — `main.py` lines 49, 74, etc.
```python
raise HTTPException(status_code=500, detail=f"Conversion failed: {exc}")
```
Leaks internal exception messages (potentially file paths, COM errors) to the client.

## Why It Matters

These are common security anti-patterns for a service that processes uploaded files. If this runs outside a trusted LAN, it exposes attack surface.

## Suggested Fix

1. Use an environment variable for allowed CORS origins: `allow_origins=os.getenv('CORS_ORIGINS', 'http://localhost:3000').split(',')`
2. Make host/port configurable via env vars
3. Log the full exception server-side but return a generic message to the client