Expose a `docx-mcp fonts download` subcommand that runs the existing `download_fonts.sh` helper, so users can fetch the embedded fonts via the binary. Keeps existing flags intact and avoids build-time network coupling.
Introduce `src/lib.rs` and library target so integration tests can import `docx_mcp`. Add focused `tests/args_tests.rs` verifying clap flag/env parsing and `SecurityConfig::from_args`/`from_env`. Enable clap `env` feature and guard the binary behind a `build-bin` feature to allow testing without unresolved MCP server deps. Fix `get_summary` to build owned strings safely.
These changes ensure argument options work correctly and are covered by comprehensive tests, independent of heavier integration suites.
Ensure PDF generation works consistently without network access by committing the Liberation and NotoSans font files used by embedded-fonts. This removes reliance on placeholder files and download-time variability.
Andy