Alternatives to HMAC + CBC? I'm looking at using HMAC + CBC. The combination looks like this:

ciphertext = AES256(text, k1)
data = HMAC-SHA256(iv | ciphertext, k2) | iv | ciphertext


Where:

k1 = 32 byte key - Randomly generated, once
k2 = 32 byte key - Randomly generated, once
iv = 16 bytes - Randomly generated, for every message


The purpose is for storing sensitive information in a database.

Is the above approach cryptographically secure for sensitive information? Would there be any reason to consider a stream-cipher mode verses a block-cipher mode like CBC?

Would an AEAD mode like OCB or CCM be more appropriate?

If an AEAD mode is not available for the platform we are using (specifically Go), is it worth the effort trying to implement these modes?
Yes, this is fine, at the record level.  (What you've built would be classified as a "Encrypt-then-Authenticate" scheme in the literature, and there are standard provable security results for such schemes.)  Well done on constructing a solid, well-engineered cryptographic scheme.

An AEAD mode would spare you from having to invent such a scheme, but what you've got is fine, and there's no reason why you need to change.

There's no reason to switch to a stream-cipher mode of operation.

As others have mentioned in the comments, this would be more secure if you included an identifier in the input to HMAC that identifies the table, row, and column where this appears, so that a ciphertext cannot be replayed from one position to another.  There will still be the risk of rollback attacks, as fgrieu explains; that is more challenging to defend against, so if you need to stop them, you might want to elaborate on the specific application situation.