I would describe it as this:
A heartbeat is a changing signal that implies that something is alive.
A watchdog timer looks over something and if it hasn't observed a change within in set time it performs an action.
So you could say that:
A heartbeat signal supplies the data that a watchdog timer consumes in order to decide whether to perform its action.
In the work I do (industrial control) I would receive a heartbeat signal from an external device and if I don't see a change within a set time I would raise an alarm that also acts to shut down running the system as I now do not know what the state of that external device is.
To expand the question concerning the software/hardware question from the microcontrollers perspective as written there is a separate oscillator (to avoid that a stop/break for some reason into the main oscillator stop the watchdog behavior) used mainly to control the dedicated watchdog timer. This timer can be configured in order to have a predeterminated amount of time before expire, usually the watchdog expiration perform a microcontroller reset so, periodically, into the application software, a dedicated instruction have to be used to reset the watchdog timer and prevent it's expiration. In what point of the code use the watchdog reset timer instruction is under programmer responsibility and then the code should be carefully examined in order to choose the better places where to put this instruction.
If I am not wrong, heartbeat is a communications check between two servers, through a point-to-point-cable so one server knows that the other one is UP, usually to escalate a server to master mode or to execute some other fail-over actions, it check hardware physical connection or availability, whereas watchdog is a process where two software components -- for example two database engines or two mutually checking high availability layers -- check each other's availability in order to escalate the itself to master mode or to execute some other fail-over action like promoting a back-end to master mode.
For example in a high availability setup with two servers, such servers can have a dedicated point-to-point network interface to check that the other node is up. If such check fails, being a physical, secure connection (usually physically close to each other like in the same data center), it can be safely assumed that the other node is down. In than same setup, both servers can have a high availability/workload balancer (to avoid a single point of failure) but then both balancers would check if the other one is down to escalate the back-ends, trigger a floating IP change etc.
Bottom-line: watchdog is for software and heartbeat is for hardware.
I'm no expert here, I just talk out of experience on a high availability rig I maintain that has two servers with PostgreSQL (master and slave) in streaming, and PGPOOL2 in each node, one active and one stand-by and a floating public IP address.