What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for?
I went through this decision process about 2 years ago and ended up going with something very conservative: encrypt-then-MAC with AES-256-CBC and HMAC-SHA-512 truncated to 256 bits.

Why SHA-512 over SHA-256?  SHA-512 is faster on 64-bit machines.  (Though recent AMD processors' SHA-256 instructions yield a 4x speed-up: link).
Why AES-256 over AES-128?  https://blog.1password.com/guess-why-were-moving-to-256-bit-aes-keys/

This was fast enough for my use cases, but is much slower than many of the alternatives.  The AES part is fast on Intel processors; hashing ends up taking ~80% of the time on long messages.
Alternatives worth considering today:
Replace HMAC-SHA-512 with keyed BLAKE3 (~2.5x faster for long messages).  BLAKE3 itself is very new, but has a somewhat mature lineage.
XChaCha20-Poly1305 (~2x faster for long messages).  Nonces can be up to 192 bits, so there's less of a risk of collisions.
AES-GCM-SIV (~5x faster for long messages).  Doesn't seem to be widely implemented yet.
Note: These performance estimates are vaguely based on a &quot;typical&quot; 2016 x86-64 processor, which has dedicated AES instructions and some general-purpose SIMD, e.g. AVX.