From a brief look - both descriptions are essentially correct as 802.11 is talking via the router (think of it as a switch in this context) to reach your box. From a higher layer perspective (the border between L2 and L3 - which ARP essentially is) your model is correct. (Victim > Attacker > Router)
From a lower layer possibly the border between L1 and L2, both devices are speaking to the router, so (Victim -> AP -> Attacker -> AP -> Router -> Internet)
So the victim device addresses a packet to the attacker, and in the process encapsulates that in an 802.11 packet addressed to the Access Point. The Access Point decapsulates and decrypts that packet, encrypts and encapsulates that packet addressed to the attacker.
To answer your other question, if it works, then yes it does circumvent the transient key (bearing in mind you already know the password to access the network).
The OSI model isn't great in practice but it's still how I think of things...
As an aside every WiFi router I've tried in the past few years (only a handful) has detected the ARP spoofing and either blocked, or repoisoned the victim with the correct address, as it realises it something is amiss. I doubt it'sthat is so common with AP's because the router is a separate device which the AP isn't so aware of. I rarely try it as in most cases its just easier to deauth the target, then capture the transient key on reconnection.