What do the security definitions of SHA-3 mean, quantitatively? In the SHA-3 standard (page 31) the security of SHA-3 is defined quantitatively, for example, they are saying SHA3-256 provides 256 bits of preimage resistance. How is this number of bits to be interpreted?

The definition of preimage resistance that I know doesn't speak of bits, but of a running time $t$ (and a success probability $\epsilon$).

Intuitively, I'd interpret it like this: An attacker can only find a preimage (with a decent probability) after running $t = 2^{256} \cdot t_H$, where $t_H$ is the time required to calculate one hash. Is that correct?

Bonus: Is there a (citable) source for this? The SHA-3 standard has shockingly few references, and the Keccak reference doesn't speak about preimage resistance at all.
Aleph's comment and pointer to the Keccak reference goes a very long way to answering this question (p. 9):



The key words here are "workload equivalent to $N$ calls to $\mathrm{Keccak-}f[r + c]$ or its inverse."  Invocations of the Keccak permutation are being used as the unit of time.  Your intuitive take that it's hash function invocations isn't very far off from this, but note that a single SHA-3 call may result in one or more permutation calls, so Claim 1 is more stringent.

In a more abstract setting, where we're talking about the sponge construction in general and not a concrete implementation like Keccak, we talk about the permutation (and its inverse) as an oracle that the adversary can freely call (often people say "query") as they see fit.  Then the security of the construction is expressed in terms of how many queries the adversary makes.  The oracle calls are treated as outputting the result of a random permutation in constant time.

See also: the Keccak team's more generic treatment of sponge functions.