Should we focus on acquisition, conversion or retention first?

Whichever is currently the biggest constraint. There is no universal order. If traffic quality is poor, CRO cannot solve everything. If the website converts badly, buying more traffic can be wasteful. If acquisition is healthy but customers rarely return, retention may have the bigger lifetime impact. I would quantify the potential upside and difficulty of each area, then prioritise accordingly.