Thank you w2w, I should have checked 4PDA earlier...
So, as far as I understand it:
-- on the MT7621 SoC, NAND and SPI buses are muxed on the same pins (therefore you can only use one at a time)
-- J10 and J11 jumpers need to be closed to enable and select the SPI flash as boot source
-- a 4.7k resistor should be soldered between pin 3 (WP) and pin 8 (VCC) of the SPI flash to disable write protection
-- we can use U-Boot from ASUS RT-N56U B1
So I soldered a blank W25Q64 (8MB) chip and discovered that you can't boot from NAND again unless you remove the SPI flash.
I also did not flash U-Boot on the SPI flash beforehand, thinking I could do it in-system using a SOIC clip; I still have to find a way to keep the MT7621 in reset (maybe through the PORST_N signal/ball).