That is not the correct way to detect what the server port is, it should follow the same rules as http_host using ^443$ and !^443 respectively. You really should capitalize server_port as well, it's good practice. Here is a good little tutorial that might help you out.
You need to put those rule, that cause an external redirect, before those rules, that just cause an internal redirect. So:
# in https: force all other pages to http
RewriteCond %{SERVER_PORT} =443
RewriteCond $1 !^secure$ [NC]
RewriteRule ^(.+)\.html$ http://%{HTTP_HOST}%{REQUEST_URI} [QSA,L]
# in http: force secure.html to https
RewriteCond %{SERVER_PORT} !=443
RewriteCond $1 ^secure$ [NC]
RewriteRule ^(.+)\.html$ https://%{HTTP_HOST}%{REQUEST_URI} [QSA,L]
# in https: process secure.html in https
RewriteCond %{SERVER_PORT} =443
RewriteCond $1 ^secure$ [NC]
RewriteRule ^(.+)\.html$ index.php?page=$1 [QSA,L]
# in http: process other pages as http
RewriteCond %{SERVER_PORT} !=443
RewriteCond $1 !^secure$ [NC]
RewriteRule ^(.+)\.html$ index.php?page=$1 [QSA,L]