### **Role & Context**
You are a Senior QA Automation Engineer and Security Tester. Your task is to write a comprehensive, automated test suite using **pytest** and **pytest-asyncio** for the FastAPI contact form submission API (`POST /api/v1/contact`).

---

### **Test Stack Requirements**
* **Framework:** `pytest`, `pytest-asyncio`
* **HTTP Client:** `httpx.AsyncClient` (for testing FastAPI endpoints asynchronously)
* **Database Strategy:** SQLite in-memory database (`sqlite+aiosqlite`) OR `testcontainers-postgres` for isolated database integration testing.
* **Mocking:** `unittest.mock` / `pytest-mock` (to mock external Cloudflare Turnstile/reCAPTCHA API responses).

---

### **Test Scope & Test Cases to Implement**

#### **1. Happy Path / Positive Tests**
* **`test_successful_contact_submission`**: Valid payload with accepted captcha token and privacy check true returns `201 Created` (or `200 OK`) and returns a UUID `submission_id`.
* Verify database side-effects: Assert that the record is correctly created in the DB with a hashed IP address and UTC timestamp.

#### **2. Field Validation & Input Bounds (422 Unprocessable Entity)**
* **Missing Required Fields:** Test payload missing `first_name`, `email`, or `inquiry_type`.
* **Invalid Inquiry Type:** Test invalid enum value (e.g., `"Inquiry Type": "Hacking Services"`).
* **Length Constraints:**
  * `first_name` exceeding max length (50+ characters).
  * `message` / `tell_us_more` less than min length (under 10 characters) or over max length (2000+ characters).
* **Privacy Policy Unchecked:** Test payload with `"privacy_agreed": false` returns validation error.

#### **3. Security & Injection Protection**
* **XSS / HTML Sanitization Test:** Send script tags (e.g., `<script>alert('xss')</script>`) in text fields (`first_name`, `message`) and assert that input is either sanitized, stripped, or safely escaped.
* **Invalid / Failed Captcha:** Mock the external Captcha verification service (`captcha.py`) to return `False` and assert the endpoint returns `400 Bad Request` or `422 Unprocessable Entity` with message `"Invalid Captcha token"`.

#### **4. Rate Limiting (429 Too Many Requests)**
* **`test_rate_limit_exceeded`**: Execute rapid requests from the same IP client (e.g., 4 consecutive requests when limit is set to 3/hour) and assert that the 4th request yields `429 Too Many Requests`.

---

### **Deliverables Needed**
1. **`conftest.py`**:
   * Async Database fixture (setting up clean test DB tables per test run).
   * FastAPI `AsyncClient` fixture with overridden dependencies (`get_db`).
   * Mock fixture for `verify_captcha` returning `True` by default.
2. **`test_contact_api.py`**: Clean, modular test functions with clear assertion messages.
3. Updated **`requirements-dev.txt`** containing testing dependencies (`pytest`, `pytest-asyncio`, `httpx`, `pytest-mock`, `aiosqlite`).

Provide the test code fully commented, following PEP 8 best practices.