Everything eventually boils down to something you know.
Even physical keys could be considered something you know as they could be reproduced if you know the exact dimension and materials. Likewise for something you are, as what you “are” has to be “read” somehow, which again is simply a matter of sending the right information to to whatever reader is being used.
But that assumes a threat model at least at the nation-state level, possibly above.
In the normal course something you have is something that can give you knowledge on demand in a secure manner. This is typically a hardware key or phone that can give you a pin code or transmit such a code to a device.
When I write down or store a password, is this then considered something I have?
No, not only is it pure knowledge, it is easily sharable knowledge.
When I have a public/private RSA-keypair with 4096 bit and I remember the private key without storing it anywhere, is it something I know?
Yes. It’s something you know, how long it is is irrelevant. You can share it with others.
When I write down or store the private part of a public/private RSA-keypair with 4096 bit, is this then considered something I have?
No, it’s something you know.
As far as I understand it "something I have" should be something I have physical access to that nobody else has. I don't see how it is possible to prove that I have something when using a web application because everything gets reduced down to the bits sent in a request and everyone could send the same bits. How does sending a specific sequence of bits prove that I have physical access to a certain device?
Depends upon what you mean by prove and what the threat model is, if your bad actor is a nation state that can observe you and your environment or duplicate your devices functionality, then it might not help at all. If someone is holding your entire family (scale that up to the world if you like) hostage you may give those bits away to someone very far from you physically. But again that is not your typical threat.
Your typical situation is that the device has been programmed in such a way that it and another device share a secret and are able to use that shared knowledge to create bits in a certain way at particular times or in response to particular input. The portable device is designed in such a way as to make it difficult to impossible to extract the shared secret from it. From this it follows that if you can produce the right bits at the right time you have access to the device. Again, this is not 100% true, if the device has a screen which shows the bits (letters or numbers) anyone that can see the screen can know the numbers whether they are physically present or not. But it’s close enough to true to be useful. Also, the shared secret could have been leaked from the other end, but again, it is close enough to true to be useful. Security isn’t about 100%, security is about being good enough to reasonably rely on.