While this is probably not enough information to determine with
certainty what happened, I am wondering: is this how a (failed?) wifi
spoofing attack would look like from the victim's point of view?
Yes (which is not the same as saying that it happened).
Specifically, someone nearby could have used
airdump-ng or equivalent to get your AP's SSID and MAC address.
Then it would have issued a forged deauth packet to log everybody off the AP. This closely matches your symptoms.
Finally it would have set up a fake access point with the same MAC and SSID, but transmitting at a markedly higher power (not really difficult this, as he's trying to overpower a smartphone). Your Mac then connects to the rogue AP.
Next thing you know, you're supplying your credentials (as Torin42 noticed, this requires some social engineering and works best with a little help from the OS) to the attacker. Who is apparently not interested in intercepting your traffic (otherwise he would have let you log, lying in wait for you to enter some other credentials such as email, home banking and such). But now that he has your credentials, he's free to hijack your access point and surf for free without any need to crack the WPA2 encryption.
The attempt failed because you changed your WiFi password, and because he did not allow you to connect to the rogue AP. The latter could have disclosed other credentials on the Mac, not doing the former would have left your AP exposed to a connection with stolen credentials.
There are diagnostic tools for PC and Android (don't know about the Mac) that would help recognize this situation - if you scan the neighbourhood with e.g. WiFi Analyzer (Play Store: com.farproc.wifi.analyzer), you would see your access point - which must be running on a different phone - with an expandable 'shadow' with the same MAC as the main one (WiFi range extenders would have the same, with two different MACs).
Or - even easier - if you turn off the AP on the phone and scan the neighbourhood, you would see your AP's name, which ordinarily could never be seen (as WiFi client and AP server functions are mutually exclusive).