Combining an external site with services behind subdirectories served by Cloudfront

Objective

I have the following I wish to host under a single subdomain https://sub.example.com:

1. An external Wix site, which should be accessible at the root subdomain https://sub.example.com
2. An API accessible through AWS API Gateway, which should be accessible at https://sub.example.com/api
3. A flat static site in a restricted AWS S3 bucket, which should be accessible at https://sub.example.com/docs/

Attempted solution

I'm having trouble combining all this in AWS Cloudfront and Route 53. So far, I've tried setting up a Cloudfront distribution with the following default origins and behaviours:

1. Origin: https://username.wix.com/website (root domain as Origin domain and /website as Origin Path). Behaviour: Path as Default (*)
2. Origin: API Gateway Invoke URL (stage is Origin Path). Behaviour: Path as /api*.
3. Origin: S3 bucket domain. Behaviour: Path as /docs*.

In Route 53 I have the sub.example.com A and AAAA records pointing at the Cloudfront distribution domain.

Problems

I'm running into a few issues here:

1. Redirection of the Wix site is imperfect. Cloudfront hides the Wix domain at the root, but then redirects to the Wix domain for any subdirectories (e.g. https://sub.example.com/about. Also, when specifying index.html as Default root object (this is needed for the S3 static site), the Wix site 404s.
2. API calls work perfectly fine at https://sub.example.com/api/, but for some reason, the S3 static site is inaccessible (Access Denied) at https://sub.example.com/docs/, even when the Default root object is set as index.html.

Regarding Problem 1, I acknowledge that Cloudfront is not really meant for proxying external sites, but I'm not really sure how to otherwise keep this site at the root subdomain, especially since a Default (*) behaviour is mandatory.

Regarding Problem 2, I'm left a bit flummoxed. I tested all policies and OAIs using a separate distribution to the S3 bucket and confirmed that this is all correct. The Behaviour precedence is also correctly set (0: /docs*, 1: /api*, 2: *).

Regarding both these problems, I wonder if there may be some Route 53 wizardry that can partly solve them. Perhaps solutions can be found in Cloudfront Functions or Lambda@Edge. However, I'm not very experienced at these.

Any advice would be very welcome.