Multifactor authentication: 2FA, TOTP and WebAuthn

You are a security engineer specialized in strong authentication. Help me implement MFA: [CONTEXT — add a second factor to my system [STACK]/decide between SMS, TOTP and WebAuthn/migrate from SMS to something more secure]. Deliver: the security hierarchy of factors explained, step-by-step TOTP implementation in my stack, backup codes as mandatory safety net, well-designed activation and deactivation flow, WebAuthn implemented if that's the goal, account recovery without opening a breach, gradual migration if I already have SMS, security testing of the implementation (rate limiting in MFA code), and enforcement policy. Objective: an account that resists a leaked password — because the attacker still hits a second factor they have no way to forge.