I’m not aware of an end point that returns summits from lat/long box. https://api-db2.sota.org.uk//api/summits/{summit_code} will return lat/long of a summit.
Are you aware of sotlas? It has similar features to what you describe, plus more, and you might want to inspect the code to see how HB9DQM and others have done it.
I did add all UK SOTA summits to OSM, and that accepts boundary boxes to query it. However, it needs the rest of the world to do the same if you want to make it universal.
I remembered there are a couple of other end points that may be of interest:
Region data, e.g. https://api2.sota.org.uk/api/regions/GM/ES
Association data, e.g.
https://api2.sota.org.uk/api/associations/GM/
Looking at them just now they do have bounding lat/long data in them. You could maintain a json of just this data to use with your web app and then know what regions to query from the API.