What are the popular modes-of-operation (AES-GCM, AES-SIV, AES-GCM-SIV, etc.) geared for? I'm interested in developing software capable of encrypting personal files (which will ultimately be backed up to the cloud) and have been doing my best to follow best practices.

There are many forms of authenticated encryption. (AES-GCM, AES-SIV, AES-GCM-SIV, CBC + HMAC, CTR + HMAC, etc.) However, I'm having a hard time determining which of these modes-of-operation suits my use-case best. Speaking broadly:

I've heard many times that "GCM is harder to get right" due to the serious risks associated with nonce reuse as well as its predisposition to side-channel attacks if implemented poorly. Although it is fast.

I know AES-SIV is at least utilized by Cryptomator, a tool similar to what I'm trying to develop, (per their architecture docs). AES-SIV has a smaller penalty for nonce reuse compared to GCM but perhaps isn't as fast. 

AES-GCM-SIV attempts to combine the positives of both GCM and SIV by being both fast and somewhat resistant to nonce reuse.

As far as CBC + HMAC is concerned, HMAC leverages 256-bit authentication tags over GHASH's weaker 128-bit authentication tags (used by GCM). However, CBC cannot be parallelized in the same way GCM can.

CTR + HMAC can be parallelized in a way similar to GCM but with stronger authentication tags. (Again, HMAC using 256-bit authentication tags over GHASH's 128-bit authentication tags)

Despite the reading I've done so far, I haven't been able to determine why one might choose one of these methods over the other. At the end of the day, I would really just like to secure my files safely in the cloud with at least some assurance that the files I encrypt are authentic and have not been tampered with or corrupted in any way. 

I would really appreciate any help that could point me in the right direction.
I went through this decision process about 2 years ago and ended up going with something very conservative: encrypt-then-MAC with AES-256-CBC and HMAC-SHA-512 truncated to 256 bits.

Why SHA-512 over SHA-256?  SHA-512 is faster on 64-bit machines.  (Though recent AMD processors' SHA-256 instructions yield a 4x speed-up: link).
Why AES-256 over AES-128?  https://blog.1password.com/guess-why-were-moving-to-256-bit-aes-keys/

This was fast enough for my use cases, but is much slower than many of the alternatives.  The AES part is fast on Intel processors; hashing ends up taking ~80% of the time on long messages.
Alternatives worth considering today:
Replace HMAC-SHA-512 with keyed BLAKE3 (~2.5x faster for long messages).  BLAKE3 itself is very new, but has a somewhat mature lineage.
XChaCha20-Poly1305 (~2x faster for long messages).  Nonces can be up to 192 bits, so there's less of a risk of collisions.
AES-GCM-SIV (~5x faster for long messages).  Doesn't seem to be widely implemented yet.
Note: These performance estimates are vaguely based on a &quot;typical&quot; 2016 x86-64 processor, which has dedicated AES instructions and some general-purpose SIMD, e.g. AVX.