UART=Hardware, SPI=Protocol?
No, UART is not necessarily a piece of hardware, nor SPI. You can implement both in software on a device that has no hardware UART or SPI. Commonly both are found inside MCUs as hardware peripherals.
A UART simply means Universal Asynchronous Receiver Transmitter. It uses the asynchronous start stop framing protocol to transmit data symbols with selectable number of bits and parity bit for error checking. For simplicity, let's assume it sends 8-bit data symbols that are called bytes. So an UART simply provides an asynchronous serial interface at the bit level.
SPI was originally a simple hardware peripheral to interface such as TTL chips that had clocked serial interfaces. It simply off-loaded byte transmission from software to hardware, with selectable clock polarity and phase setting. So an SPI provides simply a byte-oriented synchronous serial interface at the bit level.
So in the end, they both are protocols how to send bits and bytes.
But that is different from a protocol that defines what those bytes mean. For example an SPI Flash chip defines a protocol how to use the chip select to delimit commands and which bytes are commands and which are data, and how they are used to read and write the Flash memory over SPI bus at high level. Same goes with for example YModem protocol which defines what those bytes mean to be able to send files over UART at high level.