2FA - do we have to do anything to enable it?

Not at all - it is 100% on the server.

No. It’s based off UTC; not local time.

What may help is if you want to check what the server’s opinion of the current code is you can use e.g. from the rails console:

pry(main)> User.find_by(username: "Supermathie").totp.now
=> "319971"