🔒 Security: Open CORS policy + no file size limit on concurrent uploads + path traversal risk

## Issues Found

### 1. Wide-open CORS (main.py:24-28)
```python
app.add_middleware(
CORSMiddleware,
allow_origins=["*"],
allow_methods=["*"],
allow_headers=["*"],
)
```
Any origin can hit the conversion endpoints. For a service that processes documents (potential attack vector for malicious .doc files exploiting Word vulnerabilities), this should be restricted.

### 2. Race condition in cleanup (main.py)
`background=cleanup(output_path)` is called in FileResponse, but `cleanup(input_path)` runs in the `finally` block synchronously. If conversion fails partway, temp files from a concurrent request with the same stem could conflict since `get_output_path` uses `input_path.with_suffix()` — two uploads with same extension get different UUIDs for input but the output path is derived from input, so this is OK. However...

### 3. No rate limiting / concurrent request limiting
With `workers=16` and no request throttling, an attacker could spawn many Word.Application COM instances simultaneously, exhausting system resources (each Word instance uses ~100MB+ RAM).

**Suggested fix:**
- Restrict CORS origins to known frontends
- Add a semaphore or rate limiter to cap concurrent conversions
- Consider adding request authentication