Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/web/scripts/migrations/backfill-veriff-duplicate-identity-fraud.ts`:
- Around line 74-94: The migration currently swallows per-partner errors and
exits 0; change main() to throw if the errored counter is >0 after processing so
failures surface (check the errored variable after batches and throw an Error
with context), and replace the bare main() call with main().catch(...) and
.finally(...) handlers that log the error, call process.exit(1) for failures,
and ensure Prisma disconnect is invoked (referencing main(), errored, and the
existing per-partner catch that logs partnerId/veriffSessionId).
- Around line 1-6: Move the side-effect import of dotenv-flow to run before any
modules that read env vars: place import "dotenv-flow/config" at the very top of
this file so it executes before importing detectDuplicateIdentityFraud,
fetchVeriffSessionDecision, VeriffRiskLabel/veriffRiskLabels, prisma and chunk;
this ensures module-initialization reads correct environment variables and
avoids uninitialized configuration during prisma and `@dub/utils` setup.