Enable Google Authenticator in Moodle

My Moodle site is on version 3.8.9 and I want every user—students, teachers, and admins—required to pass Google Authenticator before they reach the dashboard.

I have not chosen a plugin yet, so the first step is your expert recommendation of a proven, actively-maintained Google Authenticator (TOTP) plugin that plays nicely with core 3.8.x. Once we agree, you will install, configure, and fully test it.

Access details: I’m not completely certain which backend routes (SSH, cPanel, Moodle admin) are enabled, so you may need to guide me through granting the credentials you need or work with me in a shared session.

Deliverables
• Recommend and justify the best Google Authenticator plugin for Moodle 3.8.9
• Install and configure it so two-factor authentication is mandatory for all accounts
• Verify operation with test logins and confirm no conflicts with existing themes or other plugins
• Provide a concise user guide explaining how clients pair their first device

If you’ve completed similar Moodle 2FA roll-outs, let me know your typical turnaround time. I’d like to move ahead as soon as you can.