When I want to upgrade a plugin, I'm prompted for FTP credentials for the server.
Are those used by the browser to connect to the server and modify the relevant files ?
Or does the server connect to itself through FTP, thus gaining write-access to the files, which Apache can't modify ?
The browser doesn't connect via FTP. The server connects to itself. WordPress does this when it doesn't have sufficient filesystem permissions to do the update itself. This is outlined in the Updating WordPress article in the Codex.
WordPress determines what method it will use to connect to the filesystem of your server based on the file ownership of your WordPress files. If the files are owned by the owner of the current process (i.e., the user under which the web server is running), and new files created by WordPress will also be owned by that user, WordPress will directly modify the files all by itself, without asking you for credentials.
WordPress won't attempt to create the new files directly if they won't have the correct ownership. Instead, you will be shown a dialog box asking for connection credentials. It is typical for the files to be owned by the FTP account that originally uploaded them. To perform the update, you just need to fill in the connection credentials for that FTP account.
Whether your files are owned by the web server user, or not, will depend on how you installed WordPress and how your server is configured. On some shared hosting platforms, it is a security risk for the files to be owned by the web server user and not a FTP user. See the tutorial on Changing File Permissions for more information, including how to configure file permissions so that multiple FTP users are able to edit the files.
