Does using crypto_stream_xor allow listeners to forge crypto_secretbox messages?
crypto_secretbox uses the first 32 bytes of XSalsa20 output as the key for Poly1305. Thus you are correct that using crypto_stream_xor on a known plaintext will reveal the authentication-key used by crypto_secretbox, allowing forgeries under that key and nonce.

Not using a key for multiple purposes is a general crypto design principle. Perhaps that's why the authors of NaCl didn't think of explicitly warning about this pitfall.