How can I rewire to remove/relocate this hidden junction box?
I'd make the argument that this is indeed repair work in the scope of 334.40
Even taking the NEC 334.40 restriction on concealed use of NM splicing devices as limiting them to repair work in existing wiring, I'd make the argument that this is a repair, as it's fixing an existing Code noncompliance in an existing building (vs. simply expanding on Code-compliant wiring).
Once you do that to extend cable #5, you can then blow the S2/S3 box out from a 4&quot; square box to a &quot;5S&quot; (really, just under 4¾&quot; square) or a true 5&quot; or 6&quot; square box, preferably one with at least 3&quot; of depth.  That should get you enough cubic inch capacity to land the cable #5 extension, as well as a 12/3 replacement for cable #3, cable #6, and a new cable for the new light, in the S2/S3 box and make all the splices there.  A replacement for cables 4 &amp; 7 is then run over to the S1 box from L1, which makes the wiring for L1 straightforward, while the red wire in the replacement for cable #3 carries the S1 switched-hot back to the S2/S3 box where it can go to cable #6 to feed L2.
As to getting the new cable up thru the top plate? Well, one could cross it over the into the other stud bay by running a 12/4 instead of the 12/3 between the two switch boxes and then running the new cable up from the S1 box, but that may require a deeper box at S1 as well as replacing the S2/S3 box with something chunky.  It also should be possible to have 2 holes in the top plate and/or fireblocking in the S2/S3 bay, with the cables split between the holes.
The alternative if you can't use the NM splice on cable #5 would be to &quot;flip&quot; the J1 junction box to the inside wall at its current height, given that rerunning cable #5 is off the table.  One could disguise it with a nifty wall sconce or such if one wished, even; I'd use a deep 4&quot; square or &quot;5S&quot; box for this job as one can put a single-gang mud ring of the appropriate size on either.