This is really well done.

A suggestion, hopefully helpful: a better approach to securing your admin console than simply layering 2FA onto it would be to expose it to a private WireGuard network. One very easy way to do that is with Tailscale, which will hook up to your GSuite authentication --- Google's 2FA stack will be far better than anything you'd likely build on your own.

Tailscale is disgustingly simple to set up. If you're a product person, it's actually upsetting how easy they've made it to get set up.